Saad Farooq
f58bdf7646
fix(cli): decline root copy on patterns Docker reads differently
...
Docker treats `[!...]` and inner `**` differently from pathspec, and
tarfile skips codecs Python was built without. Decline on those patterns,
detect compressed archives by magic bytes, and pin the saved-Dockerfile
and compose paths to per-entry copies.
2026-11-02 19:15:10 -05:00
Saad Farooq
cfb0fcc435
fix(cli): only collapse the uv root copy for immediate builds
...
A saved Dockerfile can be built after the tree changes, and ADD . would
then pick up entries the generation-time check never saw (.venv, .git,
symlinks). Gate the single copy behind single_root_copy, which only
build_docker_image sets.
2026-11-02 18:51:49 -05:00
Saad Farooq
777df4d7da
refactor(cli): trim root-copy guard and its tests
2026-11-02 18:24:40 -05:00
Saad Farooq
2d4b6a6ce7
perf(cli): copy uv project root in a single layer when equivalent
...
In uv.lock mode the root package was copied with one ADD per top-level
entry. Emit a single ADD . when that provably yields the same files, and
keep the per-entry walk otherwise.
2026-11-02 18:13:47 -05:00
Elior Nataf Lackritz
9791c686ee
fix(sdk-py): rejoin a run stream that closes before the run ends ( #9554 )
...
Fixes #9016
A run stream whose response ends cleanly before the run does, say on a
proxy timeout or a server restart, looked like a finished run:
`HttpClient.stream` and `SyncHttpClient.stream` reconnect to the
`Location` only when the connection fails, so the caller got a cut
answer and no error. Servers generally send no `end` event when a run
ends, so a clean close alone cannot tell the cases apart, and
reconnecting on every clean close would end every finished run in five
empty reconnects and an error.
**The rule.** After a clean close, when the stream's `Location` is a
run's stream (`<prefix>/threads/{thread_id}/runs/{run_id}/stream`, any
query) and no `end` or `error` event arrived across reconnects, the
client sends `GET <prefix>/threads/{thread_id}/runs/{run_id}` with the
reconnect headers, but `Accept: application/json` and no
`Last-Event-ID`.
- `pending` or `running`, or a 429, 5xx or transport error (the restart
that closed the stream can fail the check too): handled like a dropped
connection, with the same `Last-Event-ID`, attempt budget, backoff and
warnings, so repeated closes with no new events end in the usual
max-attempts error.
- Any other status, a 4xx other than 429, or a body that isn't a run:
the stream ends as it does today. The check never raises and uses the
client's normal timeout.
Thread streams, streams without a `Location`, and the threadless
`/runs/{run_id}/stream` `Location` older servers send for stateless runs
are unchanged. A stateless run whose `Location` names its temporary
thread is checked like any other run: it rejoins while the run is
pending or running, and once the run ends and the thread is deleted the
check gets a 404 and the stream ends. As after a drop, runs created
without `stream_resumable=True` reconnect without a cursor and warn.
**Cost.** One extra GET at the end of every run stream that ends without
an `end` or `error` event. It returns the whole run record, `kwargs`
(the run's input) included, so a run started with a large input
downloads it again. With a server that sends neither event, that is
every run stream, so the iterator finishes about one round trip later.
**Tests.** The new tests mock the transport, and `main` stops at the
first clean close. 38 of the 50 new cases fail on `main`; the 12
no-check cases pass on both.
Thanks to @Bruce-Yii for the report and root cause, and to
@anushamukka9, whose #9023 proposed reconnecting after a clean close;
this version asks the run first.
Paired JS change: https://github.com/langchain-ai/langgraphjs/pull/3185
2026-11-02 19:57:22 +00:00
dependabot[bot]
ee3c043bdd
chore(deps): bump langgraph from 1.2.3 to 1.2.14 in /libs/cli ( #9512 )
...
Bumps [langgraph](https://github.com/langchain-ai/langgraph ) from 1.2.3
to 1.2.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph's
releases</a>.</em></p>
<blockquote>
<h2>langgraph==1.2.14</h2>
<p>Changes since 1.2.13</p>
<ul>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<h2>langgraph==1.2.13</h2>
<p>Changes since 1.2.12</p>
<ul>
<li>fix(langgraph): fork before replaying an update checkpoint the
thread moved past (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9170 ">#9170</a>)</li>
<li>fix(langgraph): keep an update_state on an older checkpoint out of
its other branches (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9165 ">#9165</a>)</li>
<li>fix(langgraph): keep DeltaChannel counters on every update_state
path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9142 ">#9142</a>)</li>
<li>release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li>fix(langgraph): don't walk history for a DeltaChannel that was never
written (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9141 ">#9141</a>)</li>
<li>fix(langgraph): don't replay an abandoned branch into a DeltaChannel
fork (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8548 ">#8548</a>)</li>
<li>chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9168 ">#9168</a>)</li>
<li>fix(langgraph): hydrate subgraph delta channels with the
caller-resolved saver (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8538 ">#8538</a>)</li>
<li>fix(langgraph): stop reporting answered interrupts in get_state (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9103 ">#9103</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group across 1 directory
with 5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9155 ">#9155</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-conformance with 2 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9145 ">#9145</a>)</li>
<li>chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5
updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9149 ">#9149</a>)</li>
<li>chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9160 ">#9160</a>)</li>
<li>chore(deps-dev): bump types-requests from 2.33.0.20260712 to
2.33.0.20260906 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9156 ">#9156</a>)</li>
<li>chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9140 ">#9140</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9138 ">#9138</a>)</li>
<li>chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9139 ">#9139</a>)</li>
<li>chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9126 ">#9126</a>)</li>
</ul>
<h2>langgraph==1.2.12</h2>
<p>Changes since 1.2.11</p>
<ul>
<li>release(langgraph): 1.2.12 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8987 ">#8987</a>)</li>
<li>chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8958 ">#8958</a>)</li>
<li>feat(langgraph): add response_schema to interrupt() (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8886 ">#8886</a>)</li>
<li>fix(langgraph): type undeclared v3 stream projections (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8596 ">#8596</a>)</li>
<li>chore(langgraph): bump mistune to 3.3.4 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8804 ">#8804</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8779 ">#8779</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
4 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8782 ">#8782</a>)</li>
<li>chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8792 ">#8792</a>)</li>
<li>chore(deps): bump the major group in /libs/langgraph with 2 updates
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8783 ">#8783</a>)</li>
<li>fix(langgraph): detect subgraphs from bytecode instead of source (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8569 ">#8569</a>)</li>
</ul>
<h2>langgraph==1.2.11</h2>
<p>Changes since 1.2.10</p>
<ul>
<li>release(langgraph): 1.2.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8595 ">#8595</a>)</li>
<li>feat(langgraph): expose <code>trace_policy</code> on
<code>add_node</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8523 ">#8523</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8533 ">#8533</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8532 ">#8532</a>)</li>
<li>release(checkpoint-postgres): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8565 ">#8565</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/70dd64065bffaa3b6ab61a33f1f020fb54db8efa "><code>70dd640</code></a>
release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/55b0e36c51d2922b11640b980fcfca1064243a96 "><code>55b0e36</code></a>
release(sdk-py): 0.4.6 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9214 ">#9214</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e "><code>d89c7e1</code></a>
fix(sdk-py): percent-encode thread_id and assistant_id in thread stream
reque...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/2d942085e214ef6b99b6f54ed4d544a7c7c5ac56 "><code>2d94208</code></a>
fix(langgraph): fork before replaying an update checkpoint the thread
moved p...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/456e2b1acc67c8c6c13bbc0e0ca8ba7e11503d17 "><code>456e2b1</code></a>
fix(langgraph): keep an update_state on an older checkpoint out of its
other ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1b84cb08733a2a0a102ed19845bf20511dcc6535 "><code>1b84cb0</code></a>
fix(langgraph): keep DeltaChannel counters on every update_state path
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9142 ">#9142</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/8e15e0d0bcffa6d3d5a776206e6e8163a3595463 "><code>8e15e0d</code></a>
release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/524b320e30a31d2660ee1a7e9b312882fe4a6c08 "><code>524b320</code></a>
fix(langgraph): don't walk history for a DeltaChannel that was never
written ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/9a0394d88b2211f299dcd69df92db3480c69ee61 "><code>9a0394d</code></a>
fix(langgraph): don't replay an abandoned branch into a DeltaChannel
fork (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8 ">#8</a>...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/7dc9195e4141c8fbd8118581b3dd61d158628aa8 "><code>7dc9195</code></a>
chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9168 ">#9168</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/1.2.3...1.2.14 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 20:33:29 -08:00
dependabot[bot]
d5b927ae4c
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 9 updates ( #9528 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.13` | `1.3.1` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.18` | `1.5.3` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.70.1` | `8.72.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.70.1` | `8.72.1` |
| [dotenv](https://github.com/motdotla/dotenv ) | `18.0.4` | `18.0.9` |
| [eslint](https://github.com/eslint/eslint ) | `10.11.0` | `10.13.0` |
|
[eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier )
| `5.5.6` | `5.5.7` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.9` | `3.9.10`
|
| [ts-jest](https://github.com/kulshekhar/ts-jest ) | `29.4.14` |
`29.4.15` |
Updates `@langchain/core` from 1.2.13 to 1.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12026 ">#12026</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- fix(core): deliver callbacks once to a handler registered twice by
merged configs</p>
<p>Merging two runnable configs that both carry the same callback
handler, as happens when an agent's <code>streamEvents()</code> runs
inside a LangGraph node with tracing on, registered that handler twice,
so it received every callback twice: every streamed chunk arrived twice.
The configured callback manager now keeps each handler once, in order,
including a handler passed as a plain object of methods that merged
configs wrapped twice.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12042 ">#12042</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): include node <code>metadata</code> in
<code>Graph.toJSON()</code> output when set, matching Python</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12048 ">#12048</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): escape <code>drawMermaid</code> node metadata labels and
leave out object values, so metadata with brackets or objects no longer
breaks Mermaid parsing</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11986 ">#11986</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2caf64da3f02730f3cd2aab0c15de6eab41a01da "><code>2caf64d</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat: stream tool-call args as <code>tool-call-delta</code> slices</p>
<p>Tool-call and server-tool-call args now stream as
<code>tool-call-delta</code> events, which carry only the new slice of
the args, instead of <code>block-delta</code> snapshots of the args so
far. A large tool call now costs about the same bytes on the wire as the
same length of text.</p>
<ul>
<li>This covers the compat bridge (any model that only implements
<code>_streamResponseChunks</code>), the OpenAI-compatible converter
(OpenAI Completions, Groq, Mistral, IBM, OpenRouter, Perplexity,
DeepSeek, Fireworks, Together AI and xAI Completions), OpenAI and xAI
Responses, Anthropic (client and server tool calls) and Bedrock
Converse. Google and Ollama still send one complete snapshot per
call.</li>
<li>A tool call's <code>id</code>, <code>name</code> and
<code>index</code> go on <code>content-block-start</code>, which carries
no args. An <code>id</code> or <code>name</code> that arrives later
reaches consumers on <code>content-block-finish</code>.</li>
<li>If you read raw events and their <code>block-delta</code>
<code>fields.args</code> mid-stream, or write agent stream transformers
that do, read <code>tool-call-delta</code> instead. <code>await
stream</code>, <code>.toolCalls</code> and the assembled message are
unchanged.</li>
<li>Upgrade your clients first. Older clients mishandle
<code>tool-call-delta</code>. You need
<code>@langchain/langgraph-sdk</code> 1.12.6 or later;
<code>@langchain/react</code>, <code>@langchain/vue</code>,
<code>@langchain/svelte</code> or <code>@langchain/angular</code> 1.2.6
or later; and <code>langchain-core</code> 1.6.13 or later for Python
clients.</li>
<li>To hold back, pin <code>@langchain/core</code> below 1.3.0. That
also keeps you on <code>@langchain/openai</code>,
<code>@langchain/anthropic</code>, <code>@langchain/aws</code> and
<code>@langchain/xai</code> versions that send snapshots.</li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.20</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11922 ">#11922</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d71c542fb1d9cd1ceb310a4759591c024cf0d57d "><code>d71c542</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): add <code>midConversationSystemMessages</code> and
<code>midConversationTools</code> to <code>ModelProfile</code>. They say
whether a chat model sends a system message after the first turn in
place, and whether it can add a tool through a message rather than the
request's tool list. Either way the prompt prefix before it stays
unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11982 ">#11982</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5af4684bd19a16bb59950801da92245733482fb3 "><code>5af4684</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): read <code>tool-call-delta</code> in
<code>ChatModelStream</code></p>
<ul>
<li><code>ChatModelStream</code> appends <code>tool-call-delta</code>
slices to a tool call's args, and still replaces them on
<code>block-delta</code></li>
<li>It ignores delta types it doesn't recognize instead of throwing
<code>Unknown delta type</code></li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11956 ">#11956</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/93d62b008e13e10f28724a5ab09ab6eda584f1cb "><code>93d62b0</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Require langsmith >=0.11.0 to include the restored NullableHeaders
type declarations.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11822 ">#11822</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e6fe66a5f902fa615f076ca71d9541f1291166 "><code>d3e6fe6</code></a>
Thanks <a href="https://github.com/dqbd "><code>@dqbd</code></a>! - Add
explicit agent address support to <code>LangChainTracer</code>, inherit
project and address destinations together, and delegate default
destination resolution to the LangSmith SDK.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11150 ">#11150</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/cea15cf9ef5216125b24f23bb5ad06b7c1a91b33 "><code>cea15cf</code></a>
Thanks <a
href="https://github.com/mdnanocom "><code>@mdnanocom</code></a>! -
fix(core): defer tool call chunk collapsing in AIMessageChunk to fix
O(n²) streaming aggregation</p>
<p><code>AIMessageChunk</code> eagerly re-ran
<code>collapseToolCallChunks</code> in its constructor on every streamed
delta <code>concat</code>, re-parsing all accumulated tool args each
time — O(n²) over a stream, which can block the event loop for seconds
on long tool-call streams. Collapsing now runs lazily, once, on first
read of <code>tool_calls</code> / <code>invalid_tool_calls</code>.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.17</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e8c5dc82ba52cff3bc08cd71f963a69596d7ea4d "><code>e8c5dc8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12047 ">#12047</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/b5135cc189adbf313f4e92c1527f96a40a546977 "><code>b5135cc</code></a>
feat(openai,langchain): support Decisions API and agent middleware (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11930 ">#11930</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/52d2ba8ea50149f2314df63b79582f8508034a3b "><code>52d2ba8</code></a>
fix(aws): use this.caller in ChatBedrockConverse to support retries (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11463 ">#11463</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
fix(core): deliver callbacks once to a handler registered twice by
merged con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
fix(core): make drawMermaid node metadata labels safe (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12048 ">#12048</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
fix(core): include node metadata in Graph.toJSON() (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12042 ">#12042</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d1d0692d8498d7e1521c854d90af0395535df4d8 "><code>d1d0692</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12044 ">#12044</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/95b191b1928ee8f4e20e51aa821f5c5fd4b8b3da "><code>95b191b</code></a>
feat(openai): refresh model profiles from models.dev (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12046 ">#12046</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/81577b3e84c3f38581e76e8335faa89511e99d74 "><code>81577b3</code></a>
fix(langchain): re-throw a drained tool from the agent's ToolNode (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12043 ">#12043</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4cbf0f5938710ce1669c679febdbea41b733a100 "><code>4cbf0f5</code></a>
chore(deps): bump the npm_and_yarn group across 2 directories with 1
update (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.13...@langchain/core@1.3.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.18 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://github.com/soarez "><code>@soarez</code></a>! -
order parallel writes by task path, like langgraph (Python) — one sort
key for live execution and every saver, instead of the task-id order <a
href="https://redirect.github.com/langchain-ai/langgraphjs/issues/2544 ">#2544</a>
added for DeltaChannel writes</p>
<p>When two or more tasks in one superstep write the same
<code>DeltaChannel</code>, their writes are now applied and replayed in
<code>(task_path, task_id, idx)</code> order — the order Python's
langgraph#8544 established — instead of task-id order. Task ids are
uuid5 hashes that include the checkpoint id, so the old order permuted
parallel writers from run to run and disagreed with Python.</p>
<ul>
<li><code>BaseCheckpointSaver.putWrites</code> takes an optional
<code>taskPath</code> (the serialized task path,
<code>taskPathStr</code>), and <code>getTuple</code>/<code>list</code>
must return <code>pendingWrites</code> in the new
<code>writesSortKey</code> order. <code>writesSortKey</code> and
<code>compareWritesSortKeys</code> are new exports of
<code>@langchain/langgraph-checkpoint</code>; every saver (memory,
SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the
path and sorts in JS — no database collation is involved.</li>
<li>SQLite and Postgres gain a <code>task_path</code> column (migrated
automatically on <code>setup()</code>; read-only pre-column SQLite
databases keep reading, with their rows keeping the old order). Redis
and MongoDB documents gain a <code>task_path</code> field. Rows written
before the upgrade keep their old order.</li>
<li>Exit-durability resumes replay delta writes in live order (port of
langgraph#9114): the resumed superstep's writes interleave with the
loaded ones by task path, later supersteps sort after every real write,
and writes loaded with the checkpoint are no longer stored twice.</li>
<li><code>bulkUpdateState</code> seals the first update superstep:
DeltaChannels touched by the base checkpoint's pending writes (and whose
version moved) snapshot on the update checkpoint, so a finished
sibling's writes and the update's can't replay in the wrong order
(partial port of langgraph#8548).</li>
<li><code>bulkUpdateState</code>/<code>updateState</code> update tasks
carry <code>(__interrupt__, i)</code> task paths, as in langgraph#9128,
so several updates in one superstep writing the same DeltaChannel replay
in the order given.</li>
<li>Send task paths become <code>[PUSH, i, false]</code> and
node-error-handler paths become <code>[*failedTask.path[:3],
"node_error_handler", false]</code> (the failed task's first
three path elements), matching Python's shapes —
<code>langgraph_path</code> task metadata changes accordingly, and task
ids of functional <code>task()</code> calls under a Send or handler task
change with them. The SDK's Send-task detection accepts both the old and
new shapes.</li>
</ul>
<p>Upgrade notes:</p>
<ul>
<li><code>PostgresSaver</code>: run <code>setup()</code> once after
upgrading, from one process, before the new version serves traffic. The
<code>task_path</code> column comes from the first new migration since
the saver shipped, and until it runs, reads and writes fail with
<code>column "task_path" does not exist</code>. Several
processes running <code>setup()</code> at once on a database that still
needs the migration can fail with a duplicate key error on
<code>checkpoint_migrations</code>.</li>
<li>Third-party checkpoint savers remain source-compatible but must now
persist the <code>taskPath</code> they are given and return
<code>pendingWrites</code> in <code>writesSortKey</code> order; the
conformance suite's new base tests enforce this. A saver that ignores
the new argument replays in task-id order and can rebuild a different
DeltaChannel value than the run produced.</li>
<li>An incomplete superstep containing stored delta writes that must
interleave with resumed or retried task writes is affected by the
upgrade, whether the incompleteness came from an interrupt, a task
error, a crash, or a drain: finish such threads with the old runtime
before upgrading writers. A single interrupted node with no finished
delta-writing siblings is safe to resume. The same applies to resuming
work that includes functional <code>task()</code> calls under a Send or
error-handler task, whose child task ids change.</li>
<li><code>@langchain/langgraph-checkpoint</code> 1.2.0 must be released
before any package requiring its new exports; the consumers' minimum
ranges are raised accordingly.</li>
</ul>
</li>
<li>
<p>Updated dependencies []:</p>
<ul>
<li><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-cli</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>]:
<ul>
<li><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<p>No changes in this release.</p>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3125 ">#3125</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Change the default <code>DeltaChannel</code> snapshot frequency from
1000 to 100 updates, matching Python. Channels now persist full
snapshots more frequently to reduce replay latency at the cost of
increased storage. Set <code>snapshotFrequency: 1000</code> explicitly
to retain the previous cadence.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f3dfbb2c3f6c4ff5d30aceca027ab19fca021bde "><code>f3dfbb2</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.8</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies []:
<ul>
<li><code>@langchain/langgraph-ui</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph-cli</code><a
href="https://github.com/1 "><code>@1</code></a>.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2887 ">#2887</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/8f8eaa8686dab8ba9d35eac9934c590ecbbe11f6 "><code>8f8eaa8</code></a>
Thanks <a
href="https://github.com/syachamaneni-lc "><code>@syachamaneni-lc</code></a>!
- add --agent-id and --agent-environment flags</li>
<li>Updated dependencies []:</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3125 ">#3125</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Change the default <code>DeltaChannel</code> snapshot frequency from
1000 to 100 updates, matching Python. Channels now persist full
snapshots more frequently to reduce replay latency at the cost of
increased storage. Set <code>snapshotFrequency: 1000</code> explicitly
to retain the previous cadence.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f3dfbb2c3f6c4ff5d30aceca027ab19fca021bde "><code>f3dfbb2</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.8</li>
</ul>
</li>
</ul>
<h2>1.5.2</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3022 ">#3022</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- Depend on <code>@langchain/protocol</code> 0.0.20, the version
<code>@langchain/langgraph-sdk</code> uses, so installs resolve a single
copy and the protocol event types stay compatible.</li>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/6e845706b9a7d12f85e9477722908cc9f7003521 "><code>6e84570</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>]:
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.2.1</li>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.6</li>
</ul>
</li>
</ul>
<h2>1.5.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3017 ">#3017</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/61b00495dd13da035d6c92a68f3294f60ca54bd7 "><code>61b0049</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- A field that changes from a DeltaChannel to a plain reducer, for
example to <code>MessagesAnnotation</code>, keeps its value on threads
written under the DeltaChannel: reads rebuild it from the stored writes
instead of returning the empty default, and the next run adds to it
instead of replacing it.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3027 ">#3027</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/af7e421cd35766296cef05d9cdc50b12a794fbeb "><code>af7e421</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- With <code>durability: "exit"</code>, resuming parallel
interrupts one at a time no longer applies a finished task's output
twice: the save at exit keeps only the writes made during that run,
instead of storing the ones loaded with the checkpoint again under new
indexes.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2986 ">#2986</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/53cc6274ee6cdb0ad7cfbbc3cc53e6f6b1af4410 "><code>53cc627</code></a>
Thanks <a href="https://github.com/byhow "><code>@byhow</code></a>! -
When one answer in a multi-answer resume fails its interrupt's
<code>responseSchema</code>, the other tasks in the step now finish
before the <code>ZodError</code> is thrown, instead of being aborted. A
task aborted after its side effects kept its answer and ran again on the
next resume. The error is unchanged, and the new
<code>isInvalidResume(error)</code> tells it apart from other errors, as
<code>is_invalid_resume</code> does in langgraph (Python).</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3038 ">#3038</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/bc010237d9904bedf411c965d14343222e300d74 "><code>bc01023</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- <code>messagesStateReducer</code> and
<code>messagesDeltaReducer</code> store message chunks as their
non-chunk class, as Python's <code>add_messages</code> does. A graph run
with <code>streamMode: "messages"</code> or
<code>streamEvents</code> now checkpoints the same
<code>AIMessage</code> as <code>invoke</code>, without a duplicate
<code>tool_call_chunks</code> copy of every tool call, and an in-place
edit to <code>tool_calls</code> (for example a rejected call in
<code>humanInTheLoopMiddleware</code>) is no longer undone when the
thread is reloaded.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/3028 ">#3028</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/ec1854a53bc5c6d88f3922a80085ca05678d4532 "><code>ec1854a</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- Resuming after some parallel interrupts were answered no longer reruns
the nodes and <code>task()</code> calls that already finished, in a
subgraph or when the resume is sent with the id of the thread's latest
checkpoint. Finished tasks now rerun only on time travel, or on a resume
at a checkpoint the thread has moved past.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/2e1fe5b3fffd87b2f7ba260da3726a2c03c2f72f "><code>2e1fe5b</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/0acf88db9fdc6441c8b3a162b7a328b9b91e115e "><code>0acf88d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/9cc54cce575ae00deb0bb5946aa457f44f485427 "><code>9cc54cc</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4690a5b9a59f4f96790fdce45160f744272ca054 "><code>4690a5b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.5</li>
</ul>
</li>
</ul>
<h2>1.5.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://github.com/soarez "><code>@soarez</code></a>! -
order parallel writes by task path, like langgraph (Python) — one sort
key for live execution and every saver, instead of the task-id order <a
href="https://redirect.github.com/langchain-ai/langgraphjs/issues/2544 ">#2544</a>
added for DeltaChannel writes</p>
<p>When two or more tasks in one superstep write the same
<code>DeltaChannel</code>, their writes are now applied and replayed in
<code>(task_path, task_id, idx)</code> order — the order Python's
langgraph#8544 established — instead of task-id order. Task ids are
uuid5 hashes that include the checkpoint id, so the old order permuted
parallel writers from run to run and disagreed with Python.</p>
<ul>
<li><code>BaseCheckpointSaver.putWrites</code> takes an optional
<code>taskPath</code> (the serialized task path,
<code>taskPathStr</code>), and <code>getTuple</code>/<code>list</code>
must return <code>pendingWrites</code> in the new
<code>writesSortKey</code> order. <code>writesSortKey</code> and
<code>compareWritesSortKeys</code> are new exports of
<code>@langchain/langgraph-checkpoint</code>; every saver (memory,
SQLite, Postgres, Redis incl. ShallowRedisSaver, MongoDB) stores the
path and sorts in JS — no database collation is involved.</li>
<li>SQLite and Postgres gain a <code>task_path</code> column (migrated
automatically on <code>setup()</code>; read-only pre-column SQLite
databases keep reading, with their rows keeping the old order). Redis
and MongoDB documents gain a <code>task_path</code> field. Rows written
before the upgrade keep their old order.</li>
<li>Exit-durability resumes replay delta writes in live order (port of
langgraph#9114): the resumed superstep's writes interleave with the
loaded ones by task path, later supersteps sort after every real write,
and writes loaded with the checkpoint are no longer stored twice.</li>
<li><code>bulkUpdateState</code> seals the first update superstep:
DeltaChannels touched by the base checkpoint's pending writes (and whose
version moved) snapshot on the update checkpoint, so a finished
sibling's writes and the update's can't replay in the wrong order
(partial port of langgraph#8548).</li>
<li><code>bulkUpdateState</code>/<code>updateState</code> update tasks
carry <code>(__interrupt__, i)</code> task paths, as in langgraph#9128,
so several updates in one superstep writing the same DeltaChannel replay
in the order given.</li>
<li>Send task paths become <code>[PUSH, i, false]</code> and
node-error-handler paths become <code>[*failedTask.path[:3],
"node_error_handler", false]</code> (the failed task's first
three path elements), matching Python's shapes —
<code>langgraph_path</code> task metadata changes accordingly, and task
ids of functional <code>task()</code> calls under a Send or handler task
change with them. The SDK's Send-task detection accepts both the old and
new shapes.</li>
</ul>
<p>Upgrade notes:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/b09eb0662358457955131fe0bfec1d7c11e7d7c5 "><code>b09eb06</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3117 ">#3117</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/e24ec8c3ff3cf4191c4988e84a26c405816976cd "><code>e24ec8c</code></a>
fix(langgraph): default delta snapshots to 100 updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3125 ">#3125</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/10e72bc10a7f1f98b4e115e0617ae7bc8162718d "><code>10e72bc</code></a>
chore(deps): bump vite, vitest, and launch-editor security fixes (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3091 ">#3091</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/0c12d5c429c97dc69d6f72cceb269a4dc920f9a5 "><code>0c12d5c</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3059 ">#3059</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a17f6098a853d1051c810f2c8dffa15e4de8f083 "><code>a17f609</code></a>
feat(sdk): read <code>tool-call-delta</code> and ignore unknown delta
variants (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3022 ">#3022</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cc29753d529caa5eed97a65e765ba26c0f88c631 "><code>cc29753</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3018 ">#3018</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/53cc6274ee6cdb0ad7cfbbc3cc53e6f6b1af4410 "><code>53cc627</code></a>
fix(langgraph): let other tasks finish when a resume value is invalid
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2986 ">#2986</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec1854a53bc5c6d88f3922a80085ca05678d4532 "><code>ec1854a</code></a>
fix(langgraph): stop a subgraph from rerunning its finished tasks on
resume (...</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/af7e421cd35766296cef05d9cdc50b12a794fbeb "><code>af7e421</code></a>
fix(langgraph): save a resumed exit run's pending writes once (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3027 ">#3027</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/bc010237d9904bedf411c965d14343222e300d74 "><code>bc01023</code></a>
fix(langgraph): store message chunks as messages in the messages
reducers (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/3 ">#3</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.5.3/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-optional-chain] safe fix
when the chain ends with a strict null comparison (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12805 ">#12805</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
parenthesize constraint in optional tuple elements (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12995 ">#12995</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unused-vars] ignore type-only
refs for after-used (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12977 ">#12977</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1166ba20e9e484167ebfe216fdb38e605e3f7598 "><code>1166ba2</code></a>
chore(type-utils): detect methods in isTypeReadonly without reading the
inter...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2f0343a694bee1ba9815e4a0f946295452deb082 "><code>2f0343a</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] bound recursive type
trav...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c49d287f046c794133b12fa94207e5ee3b846ddd "><code>c49d287</code></a>
chore: [ci] test on oldest supported TS version (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13024 ">#13024</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/594fe286ec518c6899a9b89141cf3220bcfb9f72 "><code>594fe28</code></a>
fix(eslint-plugin): [no-unnecessary-condition] false positives on
unresolved ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c6eb98c17cbeee540d3c48d1406098430b2f0660 "><code>c6eb98c</code></a>
feat(eslint-plugin): [await-thenable] add
<code>allowMixedPromiseArrays</code> option (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b382b74579e5514c247ed54d0dfc428f3a173f3a "><code>b382b74</code></a>
fix(type-utils): discriminateAnyType crashes when calling getAwaitedType
on a...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79edd896790b031457fc0ca6f81c732b29921c9d "><code>79edd89</code></a>
fix(eslint-plugin): [require-array-sort-compare] ignore extra this type
argum...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.1 (2026-10-05)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.0 (2026-09-28)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7488d681f6e0e96c2aaa1eee9c3d1b9b1ef077cb "><code>7488d68</code></a>
chore(release): publish 8.71.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d57b8da272375b6a45270639894a793933208a91 "><code>d57b8da</code></a>
chore(release): publish 8.71.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8695664c5ee3fbb8fd76907fc45e148579cc3162 "><code>8695664</code></a>
chore(release): publish 8.71.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `dotenv` from 18.0.4 to 18.0.9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md ">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.8...v18.0.9 ">18.0.9</a>
(2026-10-14)</h2>
<h3>Changed</h3>
<ul>
<li>Permit DOTENV_PATH being empty string with the CLI (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1076 ">#1076</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.7...v18.0.8 ">18.0.8</a>
(2026-10-14)</h2>
<h3>Changed</h3>
<ul>
<li>Fast parser should strip appended extra quotes (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1073 ">#1073</a>)</li>
<li>Type detail improvement (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1074 ">#1074</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.6...v18.0.7 ">18.0.7</a>
(2026-10-09)</h2>
<h3>Changed</h3>
<ul>
<li>Treat undefined settings like <code>quiet: true</code> as null
rather than falsey (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1070 ">#1070</a>)</li>
<li>CLI should honor <code>DOTENV_QUIET</code> setting in
<code>.env</code> file (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1071 ">#1071</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.5...v18.0.6 ">18.0.6</a>
(2026-10-06)</h2>
<h3>Changed</h3>
<ul>
<li>Use smarter <code>parseBoolean</code> not Boolean() to fix override
(<a
href="https://redirect.github.com/motdotla/dotenv/pull/1069 ">#1069</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.4...v18.0.5 ">18.0.5</a>
(2026-09-30)</h2>
<h3>Changed</h3>
<ul>
<li>Fix missing typescript module declaration (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1068 ">#1068</a>)</li>
<li>Improve performance for large .env files (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1066 ">#1066</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/8d1ab850aa628781929f08bfd0d71ba1d1bf0a23 "><code>8d1ab85</code></a>
18.0.9</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/59a40ce5876a661d3964cc0269208267174ea39b "><code>59a40ce</code></a>
changelog</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/88228bd02b9ce98a79442ddcd619e4c31199474c "><code>88228bd</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1076 ">#1076</a>
from Enesuygurs/fix/cli-empty-dotenv-path</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/bc6ef941200c2015ffcc17d40c4f8f76ffe24026 "><code>bc6ef94</code></a>
fix(cli): load the default .env when DOTENV_PATH is empty</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/6d6e6c58074adc12131ec6ab6eac92fb92484dbc "><code>6d6e6c5</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1075 ">#1075</a>
from kory-kaai/test/fast-parser-branch-coverage</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/10218f1b0fa1f83f0714dc3c8133d0daa54752ff "><code>10218f1</code></a>
test(parse-fast): cover the size-dependent and export-prefix
branches</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/e2fe95e8e952e881787d8207b654c80326f821d8 "><code>e2fe95e</code></a>
18.0.8</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/7aa712ab2914c0cf128ea8ccdaf5e918a867db59 "><code>7aa712a</code></a>
type detail improvement</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/53405b0b140debc002e41c5abb671d5da5f3e8f9 "><code>53405b0</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1074 ">#1074</a>
from himanshu748/codex/fix-dotenv-populate-undefined...</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/0b4843a90d6d70b110d1f1a309f209c3d8d7cb6e "><code>0b4843a</code></a>
changelog</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v18.0.4...v18.0.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.11.0 to 10.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.13.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)
(Irfan fandi)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e "><code>66ac583</code></a>
feat: check <code>yield*</code> expressions in
<code>no-unsafe-optional-chaining</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21399 ">#21399</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3 "><code>87bd2ce</code></a>
fix: avoid redeclared <code>let</code> when <code>no-var</code> and
<code>one-var</code> fix together (<a
href="https://redirect.github.com/eslint/eslint/issues/21389 ">#21389</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)
(lumir)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24 "><code>47b7063</code></a>
chore: update dependency <code>@eslint/json</code> to ^2.1.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21398 ">#21398</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6 "><code>e5aea41</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21390 ">#21390</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.12.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5 "><code>4618052</code></a>
feat: handle astral letters in <code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21357 ">#21357</a>)
(sary)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa "><code>4ec5168</code></a>
feat: allow <code>SourceCode#getText()</code> to accept tokens and
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21340 ">#21340</a>)
(electrohyun)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7 "><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373 ">#21373</a>)
(Daniel Pinto)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038 "><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332 ">#21332</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a "><code>efc4d6b</code></a>
fix: astral letters in <code>consistent-return</code>,
<code>no-eval</code>, <code>no-invalid-this</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21360 ">#21360</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba "><code>93de066</code></a>
fix: prefer-exponentiation-operator autofix for async function base (<a
href="https://redirect.github.com/eslint/eslint/issues/21322 ">#21322</a>)
(Vladimir Babin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5 "><code>02e34ff</code></a>
fix: add missing space after <code>else</code> in <code>curly</code>
autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21355 ">#21355</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160 "><code>b14b8bc</code></a>
fix: correct <code>id-length</code> message for long private names (<a
href="https://redirect.github.com/eslint/eslint/issues/21348 ">#21348</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8 "><code>69aac01</code></a>
fix: support <code>TSFunctionType</code> in
<code>getFunctionHeadLoc</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21335 ">#21335</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532 "><code>686630e</code></a>
fix: <code>no-loss-of-precision</code> false positive with
<code>0.e5</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21337 ">#21337</a>)
(sethamus)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f "><code>67eb586</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21 "><code>5370d7e</code></a>
docs: clarify <code>one-var</code> <code>separateRequires</code> matches
any <code>require()</code> call (<a
href="https://redirect.github.com/eslint/eslint/issues/21192 ">#21192</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f "><code>8816c1d</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e "><code>3d2e7ce</code></a>
docs: fix typo in no-unused-expressions documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21346 ">#21346</a>)
(bytedoe)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6 "><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362 ">#21362</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e "><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376 ">#21376</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177 "><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364 ">#21364</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc8 ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:52 -08:00
dependabot[bot]
937d4027bf
chore(deps): bump the minor-and-patch group with 6 updates ( #9522 )
...
Bumps the minor-and-patch group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [docker/login-action](https://github.com/docker/login-action ) |
`4.6.0` | `4.7.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact )
| `7.0.1` | `7.0.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact )
| `8.0.1` | `8.0.2` |
|
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish )
| `1.14.2` | `1.14.3` |
| [actions/setup-python](https://github.com/actions/setup-python ) |
`7.0.0` | `7.1.0` |
|
[actions/create-github-app-token](https://github.com/actions/create-github-app-token )
| `3.2.0` | `3.3.0` |
Updates `docker/login-action` from 4.6.0 to 4.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.0</h2>
<ul>
<li>Preserve explicit ECR settings in <code>registry-auth</code> by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1089 ">docker/login-action#1089</a></li>
<li>Use registry hosts for scoped credentials by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1088 ">docker/login-action#1088</a></li>
<li>Raise Docker Hub OIDC max expiry to 6 hours by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1068 ">docker/login-action#1068</a></li>
<li>Log Docker Hub OIDC token exchange progress by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1061 ">docker/login-action#1061</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1154.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1093 ">docker/login-action#1093</a></li>
<li>Bump <code>@docker/actions-toolkit</code> from 0.94.0 to 0.107.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1100 ">docker/login-action#1100</a></li>
<li>Bump <code>@humanfs/node</code> from 0.16.7 to 0.16.8 in <a
href="https://redirect.github.com/docker/login-action/pull/1077 ">docker/login-action#1077</a></li>
<li>Bump csv-parse from 7.0.1 to 7.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1078 ">docker/login-action#1078</a></li>
<li>Bump handlebars from 4.7.9 to 4.7.10 in <a
href="https://redirect.github.com/docker/login-action/pull/1091 ">docker/login-action#1091</a></li>
<li>Bump js-yaml from 5.2.2 to 5.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1066 ">docker/login-action#1066</a></li>
<li>Bump postcss from 8.5.22 to 8.5.26 in <a
href="https://redirect.github.com/docker/login-action/pull/1071 ">docker/login-action#1071</a></li>
<li>Bump postcss-selector-parser from 7.1.1 to 7.1.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1092 ">docker/login-action#1092</a></li>
<li>Bump source-map-js from 1.2.1 to 1.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1090 ">docker/login-action#1090</a></li>
<li>Bump undici from 6.27.0 to 6.29.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1085 ">docker/login-action#1085</a></li>
<li>Bump uuid from 14.0.1 to 14.0.3 in <a
href="https://redirect.github.com/docker/login-action/pull/1096 ">docker/login-action#1096</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.6.0...v4.7.0 ">https://github.com/docker/login-action/compare/v4.6.0...v4.7.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/81c6f93d4bc991e510b342a00b419b3bb4efc5c6 "><code>81c6f93</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1100 ">#1100</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b16c8d1815e1d951d87a3522ff48a76d073735a "><code>1b16c8d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1096 ">#1096</a>
from docker/dependabot/npm_and_yarn/uuid-14.0.3</li>
<li><a
href="https://github.com/docker/login-action/commit/ac86b5e9e9d2db43b12b2d3afb9140a427d69d65 "><code>ac86b5e</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/1476d845f08dd8309a938959a280f2e23c0cba14 "><code>1476d84</code></a>
build(deps): bump <code>@docker/actions-toolkit</code> from 0.94.0 to
0.107.0</li>
<li><a
href="https://github.com/docker/login-action/commit/503cee68d85e94275776fcc6f5315f19207f7567 "><code>503cee6</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1095 ">#1095</a>
from docker/dependabot/github_actions/actions/create...</li>
<li><a
href="https://github.com/docker/login-action/commit/f0935357f5c539aeb7ff6b886ba5434ab76e9de3 "><code>f093535</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1099 ">#1099</a>
from docker/dependabot/github_actions/codecov/codeco...</li>
<li><a
href="https://github.com/docker/login-action/commit/d5ae7f188776587b12b77b45e29ea21332462da9 "><code>d5ae7f1</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1098 ">#1098</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/6f9750797f6e7186f18c069a7e97abc1dcf1006b "><code>6f97507</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1097 ">#1097</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/006d61fa598847d65f6670d1569545fa2af9cf02 "><code>006d61f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1094 ">#1094</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/93f5f522eea5eacabf35cc89b9d19ec23e742471 "><code>93f5f52</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1093 ">#1093</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases ">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Updates <code>@actions/artifact</code> to v6.3.1.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d "><code>@tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/821 ">actions/upload-artifact#821</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2 ">https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9 "><code>cf430e0</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/822 ">#822</a>
from actions/tunc-d-prepare-upload-v7-0-2</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/c2acdedd35a8824a1552c7137f8c18288c3ea469 "><code>c2acded</code></a>
chore: prepare v7.0.2 release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/4687c1bbaa0a58abb517d90b4bbade6754c80c1a "><code>4687c1b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/821 ">#821</a>
from actions/tunc-d-upload-artifact-package-bump</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8cbe1bebdb858105d8fdd88f81404d4de4595719 "><code>8cbe1be</code></a>
Bump <code>@actions/artifact</code> to 6.3.1</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/download-artifact` from 8.0.1 to 8.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases ">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme by <a
href="https://github.com/danwkennedy "><code>@danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/473 ">actions/download-artifact#473</a></li>
<li>Improves artifact download retries when the service returns HTTP 429
(rate limiting), including honoring valid Retry-After headers.</li>
<li>Update <code>@actions/artifact</code> to 6.3.1 by <a
href="https://github.com/tunc-d "><code>@tunc-d</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/492 ">actions/download-artifact#492</a></li>
<li>Prepare download-artifact v8.0.2 by <a
href="https://github.com/tunc-d "><code>@tunc-d</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/493 ">actions/download-artifact#493</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tunc-d "><code>@tunc-d</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/492 ">actions/download-artifact#492</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2 ">https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333 "><code>9000827</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/493 ">#493</a>
from actions/tunc-d-prepare-download-v8-0-2</li>
<li><a
href="https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5 "><code>e455989</code></a>
Prepare download-artifact v8.0.2</li>
<li><a
href="https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137 "><code>a00b90c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/492 ">#492</a>
from actions/tunc-d-download-artifact-package-bump</li>
<li><a
href="https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f "><code>29bb7ce</code></a>
Update <code>@actions/artifact</code> to 6.3.1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317 "><code>484a0b5</code></a>
Update the readme (<a
href="https://redirect.github.com/actions/download-artifact/issues/473 ">#473</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/gh-action-pypi-publish/releases ">pypa/gh-action-pypi-publish's
releases</a>.</em></p>
<blockquote>
<h2>v1.14.3</h2>
<!-- raw HTML omitted -->
<blockquote>
<p>[!important]
🚨 This release includes fixes for <a
href="https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9 ">GHSA-5xjx-3w67-w9x9</a>
patched up by <a
href="https://github.com/sethmlarson "><code>@sethmlarson</code></a><a
href="https://github.com/sponsors/sethmlarson ">💰 </a> in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427 ">#427</a>
and in other places across the ecosystem.</p>
<p>Additional ecosystem and related mitigations beyond you might want to
watch out for:</p>
<ul>
<li><a
href="https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 ">https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 </a></li>
<li><a
href="https://emudhra.we-have-a-problem.com ">https://emudhra.we-have-a-problem.com </a></li>
</ul>
</blockquote>
<h2>🛠️ Security Tightening</h2>
<p><a href="https://github.com/webknjaz "><code>@webknjaz</code></a><a
href="https://github.com/sponsors/webknjaz ">💰 </a> made sure the
dependency tree within the action runtime uses hash-checking from now on
via <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/420 ">pypa/gh-action-pypi-publish#420</a>.</p>
<p><strong>🪞 Full Diff</strong>: <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3 ">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3 </a></p>
<p><strong>🧔♂️ Release Manager:</strong> <a
href="https://github.com/sponsors/webknjaz "><code>@webknjaz</code></a>
<a href="https://stand-with-ukraine.pp.ua ">🇺🇦 </a></p>
<p><strong>💬 Discuss</strong> <a
href="https://bsky.app/profile/webknjaz.me/post/3mydcjweyak2f ">on
Bluesky 🦋 </a>, <a
href="https://mastodon.social/@webknjaz/117474743338290807 ">on Mastodon
🐘 </a> and <a
href="https://github.com/pypa/gh-action-pypi-publish/discussions/429 ">on
GitHub</a>.</p>
<p><a href="https://github.com/sponsors/webknjaz "><img
src="https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c "
alt="GH Sponsors badge" /></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/7245906fb61fa33a13554f9d5fb856fe61758086 "><code>7245906</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/427 ">#427</a>
from sethmlarson/certifi-sigstore</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/331eccb0e13a5c1124ed9f414a079ef2bef1095f "><code>331eccb</code></a>
Upgrade certifi and sigstore</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/f68fee44f9faa979857cda34894b750df5f571ca "><code>f68fee4</code></a>
💰 Sync the FUNDING config</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/c0d6f8e4af2ad8247a7da213b199ea78dac8395e "><code>c0d6f8e</code></a>
Merge branch 'integrity/runtime/deptree' into unstable/v1</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/909009990f9cf7e7c6a64e602638cf9e91af47f8 "><code>9090099</code></a>
🧪 Make smoke test deps hash-pinned in CI</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/34e40c24acd7b4a9150956d646c8c7ba667a14f3 "><code>34e40c2</code></a>
📌 Bump pip-tools managed transitive deptrees</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/e800ed547ac29cbc9324311809e2f36fe82148f9 "><code>e800ed5</code></a>
👷 Enable hash-checking in the runtime deptree 🔗 </li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/dd8c5f4f1f65ddf01533969008446145facc7b02 "><code>dd8c5f4</code></a>
🔧 Make pip-tools config available in container</li>
<li>See full diff in <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/setup-python` from 7.0.0 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases ">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Add <code>mirror</code> and <code>mirror-token</code> inputs for
custom Python distribution sources by <a
href="https://github.com/luhenry "><code>@luhenry</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1302 ">actions/setup-python#1302</a></li>
<li>Improve error message clarity by <a
href="https://github.com/v-lmvysakh "><code>@v-lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1351 ">actions/setup-python#1351</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Upgrade browserslist from 4.28.2 to 4.28.9 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1353 ">actions/setup-python#1353</a></li>
<li>Upgrade <code>@typescript-eslint/parser</code> from 8.62.0 to
8.70.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1343 ">actions/setup-python#1343</a></li>
<li>Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1342 ">actions/setup-python#1342</a></li>
<li>Upgrade <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1357 ">actions/setup-python#1357</a></li>
<li>Upgrade <code>@types/semver</code> from 7.7.1 to 7.8.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1359 ">actions/setup-python#1359</a></li>
<li>Upgrade undici from 6.28.0 to 6.29.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1364 ">actions/setup-python#1364</a></li>
<li>Upgrade ts-jest from 29.4.11 to 29.4.14 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1361 ">actions/setup-python#1361</a></li>
<li>Upgrade brace-expansion from 5.0.9 to 5.0.12 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1365 ">actions/setup-python#1365</a></li>
<li>Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to
7.1.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1363 ">actions/setup-python#1363</a></li>
<li>Upgrade <code>@typescript-eslint/eslint-plugin</code> from 8.62.0
to 8.71.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1369 ">actions/setup-python#1369</a></li>
<li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1345 ">actions/setup-python#1345</a></li>
<li>Upgrade cache to 6.3.0 by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1370 ">actions/setup-python#1370</a></li>
<li>Resolve Basic Validation audit failures by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1347 ">actions/setup-python#1347</a></li>
<li>Resolve npm audit failures by <a
href="https://github.com/v-HarithaVattikuti "><code>@v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1350 ">actions/setup-python#1350</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/luhenry "><code>@luhenry</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1302 ">actions/setup-python#1302</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0 ">https://github.com/actions/setup-python/compare/v7.0.0...v7.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 "><code>6d4fd22</code></a>
Cache upgrade to 6.3.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1370 ">#1370</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ec52d0af729a7c50ced4261d17a07916f43f5b8e "><code>ec52d0a</code></a>
Bump <code>@typescript-eslint/eslint-plugin</code> from 8.62.0 to
8.71.1 (<a
href="https://redirect.github.com/actions/setup-python/issues/1369 ">#1369</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ff73b2463e2f3baa703f830da214b8dfeeaeccf8 "><code>ff73b24</code></a>
Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0
(<a
href="https://redirect.github.com/actions/setup-python/issues/1363 ">#1363</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0e40890053525508c059c61932a6b8614f9e95db "><code>0e40890</code></a>
Bump brace-expansion from 5.0.9 to 5.0.12 (<a
href="https://redirect.github.com/actions/setup-python/issues/1365 ">#1365</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/3892123fbe74688ccc83ec7c465dc688359e5199 "><code>3892123</code></a>
Bump ts-jest from 29.4.11 to 29.4.14 (<a
href="https://redirect.github.com/actions/setup-python/issues/1361 ">#1361</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/660965736c4aecc62797ea07d351a3c259f14660 "><code>6609657</code></a>
Bump undici from 6.28.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1364 ">#1364</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/e1be392b26fb1917a7b2c455817e4b4dad6544ce "><code>e1be392</code></a>
Bump <code>@types/semver</code> from 7.7.1 to 7.8.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1359 ">#1359</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/06da6279cdbca41027908073e81a4544dc79c06b "><code>06da627</code></a>
Bump <code>@vercel/ncc</code> from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1357 ">#1357</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/af9bcc7548695e66d75709de6f29e337624b8de8 "><code>af9bcc7</code></a>
Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (<a
href="https://redirect.github.com/actions/setup-python/issues/1342 ">#1342</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/7aeabeba5501120d873c50398519dbfd0657031c "><code>7aeabeb</code></a>
Bump <code>@typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a
href="https://redirect.github.com/actions/setup-python/issues/1343 ">#1343</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/create-github-app-token/releases ">actions/create-github-app-token's
releases</a>.</em></p>
<blockquote>
<h2>v3.3.0</h2>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0 ">3.3.0</a>
(2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e ">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb ">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across
1 directory with 3 updates (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/395 ">#395</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 ">a69c19d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md ">actions/create-github-app-token's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.2.0...v3.3.0 ">3.3.0</a>
(2026-10-12)</h2>
<h3>Features</h3>
<ul>
<li>update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e ">a47236f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb ">12461a3</a>)</li>
<li><strong>deps:</strong> bump the production-dependencies group across
1 directory with 3 updates (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/395 ">#395</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 ">a69c19d</a>)</li>
</ul>
<h2><a
href="https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0 ">3.2.0</a>
(2026-05-12)</h2>
<h3>Features</h3>
<ul>
<li>add support for enterprise-level GitHub Apps (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/263 ">#263</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/952a2a7073df6bfa5f49bc469ec895b6ec1acea4 ">952a2a7</a>)</li>
<li>support full repository names in <code>repositories</code> input (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/372 ">#372</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/85eb8dd41472213aed25d1a126460e0069138ab6 ">85eb8dd</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> bump <code>@actions/core</code> from 3.0.0
to 3.0.1 in the production-dependencies group (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/364 ">#364</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/43e5c345bfd4d4f3ecea019ad0042001a09dd857 ">43e5c34</a>)</li>
<li>validate private-key input (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/376 ">#376</a>)
(<a
href="https://github.com/actions/create-github-app-token/commit/f24bbd89643991c0de27ae823c01791b2c6bafdd ">f24bbd8</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/create-github-app-token/commit/64ab729a6294000f5aa4a4bc0b73d1f32bc45510 "><code>64ab729</code></a>
chore(main): release 3.3.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/402 ">#402</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/f3a828e4b91180d3a46ac1f4b43fa8384b0dea07 "><code>f3a828e</code></a>
ci: create signed dist commits in release workflow (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/404 ">#404</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/655017ffa7c6b0c6e4210729fa6bce35cacd8ca0 "><code>655017f</code></a>
docs: clarify when owner grants access to all repositories (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/378 ">#378</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/12461a3a794e67c032f1eff5bb95ece9427eb4fb "><code>12461a3</code></a>
fix(deps): bump nested undici from 6.24.0 to 6.29.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/403 ">#403</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/a47236f79f79fcbc3532af49fe3a5ded89529b6e "><code>a47236f</code></a>
feat: update permission inputs (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/399 ">#399</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/a69c19ddfdf8e1ab093900e0064524ce9309c807 "><code>a69c19d</code></a>
fix(deps): bump the production-dependencies group across 1 directory
with 3 u...</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/d5cb7ae41d64331820d88810a4878e0942ec992a "><code>d5cb7ae</code></a>
build(deps): bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/384 ">#384</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/575da866bd0a42d7f234a8645831d55573252b09 "><code>575da86</code></a>
build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to
7.2.0 in...</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/e85f677b44da0d1f08115ce52cdfd8fd2c69874a "><code>e85f677</code></a>
test: omit stack traces from snapshots (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/401 ">#401</a>)</li>
<li><a
href="https://github.com/actions/create-github-app-token/commit/9419396df4d5672241cfb593dadc19758e54a204 "><code>9419396</code></a>
build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (<a
href="https://redirect.github.com/actions/create-github-app-token/issues/400 ">#400</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:44 -08:00
dependabot[bot]
50303e0ba1
chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example with 8 updates ( #9526 )
...
Bumps the minor-and-patch group in /libs/cli/js-monorepo-example with 8
updates:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo ) | `2.11.5` | `2.11.10` |
| [eslint](https://github.com/eslint/eslint ) | `10.11.0` | `10.13.0` |
|
[eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier )
| `5.5.6` | `5.5.7` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.70.1` | `8.72.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.70.1` | `8.72.1` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.9` | `3.9.10`
|
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.13` | `1.3.1` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.18` | `1.5.3` |
Updates `turbo` from 2.11.5 to 2.11.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases ">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.11.10</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>fix: Allow non-recursive Turbo commands in root tasks by <a
href="https://github.com/sahyl "><code>@sahyl</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14814 ">vercel/turborepo#14814</a></li>
<li>chore: Release Turborepo 2.11.9 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14824 ">vercel/turborepo#14824</a></li>
<li>chore(deps): Update dependency <code>@vercel/geistdocs</code> to v2
by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14417 ">vercel/turborepo#14417</a></li>
<li>chore: Update with-gatsby example by <a
href="https://github.com/vercel-gh-bot-3 "><code>@vercel-gh-bot-3</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14796 ">vercel/turborepo#14796</a></li>
<li>fix: Avoid pnpm batch-shim shutdown hangs on Windows by <a
href="https://github.com/sahyl "><code>@sahyl</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14819 ">vercel/turborepo#14819</a></li>
<li>chore(deps): Update dependency <code>@vercel/geistdocs</code> to
v2.11.0 by <a
href="https://github.com/vercel-gh-bot-3 "><code>@vercel-gh-bot-3</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14832 ">vercel/turborepo#14832</a></li>
<li>fix: Exclude tool-managed directories from local dependency inputs
by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14696 ">vercel/turborepo#14696</a></li>
<li>fix: Match git's text=auto binary detection in file hashing by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14697 ">vercel/turborepo#14697</a></li>
<li>fix: Drop <code>@react-router/dev</code> from Remix match list by
<a
href="https://github.com/Pcmhacker-piro "><code>@Pcmhacker-piro</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14800 ">vercel/turborepo#14800</a></li>
<li>fix: Match package configuration files and directory inputs in
task-level affected detection by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14804 ">vercel/turborepo#14804</a></li>
<li>fix: Parse pnpm 8 single-project lockfiles by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14806 ">vercel/turborepo#14806</a></li>
<li>fix: Keep task env vars in the hash when globalEnv excludes inferred
vars by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14805 ">vercel/turborepo#14805</a></li>
<li>docs: Generate the sitemap from Geistdocs sources by <a
href="https://github.com/molebox "><code>@molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14865 ">vercel/turborepo#14865</a></li>
<li>fix: Restore cached symlinks when outputs are already on disk by <a
href="https://github.com/PedroRosalba "><code>@PedroRosalba</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14807 ">vercel/turborepo#14807</a></li>
<li>chore: Remove CODEOWNERS file by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
with <a href="https://github.com/Copilot "><code>@Copilot</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14810 ">vercel/turborepo#14810</a></li>
<li>feat: Enable WebMCP for Turborepo docs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14828 ">vercel/turborepo#14828</a></li>
<li>fix: Exit quietly when <code>turbo ls</code> output is piped to a
closed reader by <a
href="https://github.com/drakeo338 "><code>@drakeo338</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/14868 ">vercel/turborepo#14868</a></li>
<li>fix: Distrust compromised eMudhra intermediate certificates by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14876 ">vercel/turborepo#14876</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vercel/turborepo/compare/v2.11.9...v2.11.10 ">https://github.com/vercel/turborepo/compare/v2.11.9...v2.11.10 </a></p>
<h2>Turborepo v2.11.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.11.8 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14789 ">vercel/turborepo#14789</a></li>
<li>perf: Prefetch Cargo metadata during lazy graph construction by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14497 ">vercel/turborepo#14497</a></li>
<li>perf: Compute Berry lockfile closures once across workspaces by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14499 ">vercel/turborepo#14499</a></li>
<li>perf: Check cache hit outputs in place instead of on the blocking
pool by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14524 ">vercel/turborepo#14524</a></li>
<li>perf: Speed up Berry lockfile loading by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14500 ">vercel/turborepo#14500</a></li>
<li>perf: Parse bun.lock without building a JSON syntax tree by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14502 ">vercel/turborepo#14502</a></li>
<li>perf: Skip the dry run cache batch window when there is no remote
cache by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14505 ">vercel/turborepo#14505</a></li>
<li>perf: Emit lockfile closures pre-sorted and cheapen closure
interning by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14525 ">vercel/turborepo#14525</a></li>
<li>perf: Reuse configuration derived from turbo.json between the shim
and the CLI by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14521 ">vercel/turborepo#14521</a></li>
<li>feat: Report locked tools-only setup plans by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14483 ">vercel/turborepo#14483</a></li>
<li>perf: Compute Bun lockfile closures once across workspaces by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14501 ">vercel/turborepo#14501</a></li>
<li>perf: Reuse open parent directories when restoring cache archives by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14506 ">vercel/turborepo#14506</a></li>
<li>perf: Skip dropping the run right before turbo run exits by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14507 ">vercel/turborepo#14507</a></li>
<li>perf: Match literal input exclusions without compiling globs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14510 ">vercel/turborepo#14510</a></li>
<li>perf: Copy pruned package files in parallel by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14512 ">vercel/turborepo#14512</a></li>
<li>feat: Report proposed first-lock and refresh setup plans by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14571 ">vercel/turborepo#14571</a></li>
<li>perf: Compress large cache archives with multithreaded zstd by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14698 ">vercel/turborepo#14698</a></li>
<li>perf: Read tracked file stats from directory listings on Windows by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14633 ">vercel/turborepo#14633</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/e521641a142a24abe4554a77fdd6551e47e96fb3 "><code>e521641</code></a>
publish 2.11.10 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/aaf5a3afdc7f1f3142ec13b6665ef099b3fb3528 "><code>aaf5a3a</code></a>
fix: Distrust compromised eMudhra intermediate certificates (<a
href="https://redirect.github.com/vercel/turborepo/issues/14876 ">#14876</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/98165036e02c9940e9b22b9ffbed98a721aa24f1 "><code>9816503</code></a>
fix: Exit quietly when <code>turbo ls</code> output is piped to a closed
reader (<a
href="https://redirect.github.com/vercel/turborepo/issues/14868 ">#14868</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/af866e5114c328a25ead2690464607214245b3f8 "><code>af866e5</code></a>
feat: Enable WebMCP for Turborepo docs (<a
href="https://redirect.github.com/vercel/turborepo/issues/14828 ">#14828</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/b42cc68b412d7be1e103f9a014a29b2f56e990e3 "><code>b42cc68</code></a>
chore: Remove CODEOWNERS file (<a
href="https://redirect.github.com/vercel/turborepo/issues/14810 ">#14810</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/921155f01d4abe946ac0265f3b37a763108ec1b3 "><code>921155f</code></a>
fix: Restore cached symlinks when outputs are already on disk (<a
href="https://redirect.github.com/vercel/turborepo/issues/14807 ">#14807</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/9330903fb870682d5c3239d2acac597fd4fb29e8 "><code>9330903</code></a>
docs: Generate the sitemap from Geistdocs sources (<a
href="https://redirect.github.com/vercel/turborepo/issues/14865 ">#14865</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/60480382670ce6ed882bb33ae59cc7be17f80279 "><code>6048038</code></a>
fix: Keep task env vars in the hash when globalEnv excludes inferred
vars (<a
href="https://redirect.github.com/vercel/turborepo/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/57ecce3b0ebed41b43c288ed9082043f29f451ac "><code>57ecce3</code></a>
fix: Parse pnpm 8 single-project lockfiles (<a
href="https://redirect.github.com/vercel/turborepo/issues/14806 ">#14806</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/d926d6a3723956eff9d07228809097b307dc978a "><code>d926d6a</code></a>
fix: Match package configuration files and directory inputs in
task-level aff...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.11.5...v2.11.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.11.0 to 10.13.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.13.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)
(Irfan fandi)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e "><code>66ac583</code></a>
feat: check <code>yield*</code> expressions in
<code>no-unsafe-optional-chaining</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21399 ">#21399</a>)
(xbinaryx)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3 "><code>87bd2ce</code></a>
fix: avoid redeclared <code>let</code> when <code>no-var</code> and
<code>one-var</code> fix together (<a
href="https://redirect.github.com/eslint/eslint/issues/21389 ">#21389</a>)
(Daniel Pinto)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)
(lumir)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24 "><code>47b7063</code></a>
chore: update dependency <code>@eslint/json</code> to ^2.1.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21398 ">#21398</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6 "><code>e5aea41</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21390 ">#21390</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.12.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5 "><code>4618052</code></a>
feat: handle astral letters in <code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21357 ">#21357</a>)
(sary)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa "><code>4ec5168</code></a>
feat: allow <code>SourceCode#getText()</code> to accept tokens and
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21340 ">#21340</a>)
(electrohyun)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7 "><code>bc51eee</code></a>
fix: <code>prefer-arrow-callback</code> false positive in conditional
test (<a
href="https://redirect.github.com/eslint/eslint/issues/21373 ">#21373</a>)
(Daniel Pinto)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038 "><code>bbff86c</code></a>
fix: skip lines with multiple comments in
<code>max-lines-per-function</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21332 ">#21332</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a "><code>efc4d6b</code></a>
fix: astral letters in <code>consistent-return</code>,
<code>no-eval</code>, <code>no-invalid-this</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21360 ">#21360</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba "><code>93de066</code></a>
fix: prefer-exponentiation-operator autofix for async function base (<a
href="https://redirect.github.com/eslint/eslint/issues/21322 ">#21322</a>)
(Vladimir Babin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5 "><code>02e34ff</code></a>
fix: add missing space after <code>else</code> in <code>curly</code>
autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21355 ">#21355</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160 "><code>b14b8bc</code></a>
fix: correct <code>id-length</code> message for long private names (<a
href="https://redirect.github.com/eslint/eslint/issues/21348 ">#21348</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8 "><code>69aac01</code></a>
fix: support <code>TSFunctionType</code> in
<code>getFunctionHeadLoc</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21335 ">#21335</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532 "><code>686630e</code></a>
fix: <code>no-loss-of-precision</code> false positive with
<code>0.e5</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21337 ">#21337</a>)
(sethamus)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f "><code>67eb586</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21 "><code>5370d7e</code></a>
docs: clarify <code>one-var</code> <code>separateRequires</code> matches
any <code>require()</code> call (<a
href="https://redirect.github.com/eslint/eslint/issues/21192 ">#21192</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f "><code>8816c1d</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e "><code>3d2e7ce</code></a>
docs: fix typo in no-unused-expressions documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21346 ">#21346</a>)
(bytedoe)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6 "><code>152067f</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21362 ">#21362</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e "><code>b56d58e</code></a>
chore: update github/codeql-action action to v4.38.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/21376 ">#21376</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177 "><code>bfaea12</code></a>
perf: cache normalized config globals per languageOptions (<a
href="https://redirect.github.com/eslint/eslint/issues/21364 ">#21364</a>)
(James Ross)</li>
<li><a
href="https://github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc853355c "><code>322209e</code></a>
ci: avoid Nx cache in ecosystem tests and disable failing test (<a
href="https://redirect.github.com/eslint/eslint/issues/21369 ">#21369</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d166567901e09940c1de4ad0e95d572eeab5c927 "><code>d166567</code></a>
chore: update dependency prettier to v3.9.9 (<a
href="https://redirect.github.com/eslint/eslint/issues/21371 ">#21371</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/29585ceba7ad35368d1b763bd1e80d899f28842c "><code>29585ce</code></a>
chore: update dependency eslint-plugin-expect-type to ^0.7.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21359 ">#21359</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/39d79ba9650542ac66d585d1899304abd630c07d "><code>39d79ba</code></a>
chore: update github/codeql-action action to v4.38.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/21354 ">#21354</a>)
(renovate[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4637f9827a1ba137498eaee70957850621082815 "><code>4637f98</code></a>
10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/96df05ceb7000813859acf16a690f8a8bbbea904 "><code>96df05c</code></a>
Build: changelog update for 10.13.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288 "><code>4783a68</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196 "><code>b59d889</code></a>
chore: update github/codeql-action action to v4.38.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21412 ">#21412</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca "><code>95e51a0</code></a>
ci: re-enable <code>@typescript-eslint/typescript-eslint</code> in
ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21410 ">#21410</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660 "><code>317fcb3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21409 ">#21409</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5 "><code>48d5cc4</code></a>
feat: report references inside IIFEs in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21238 ">#21238</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd "><code>43f0ac9</code></a>
docs: clarify parameter description in <code>getText</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21287 ">#21287</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450 "><code>a39d9fb</code></a>
feat: add <code>globalThis</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21382 ">#21382</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887 "><code>b92decf</code></a>
perf: skip no-redeclare scan for single-declaration variables (<a
href="https://redirect.github.com/eslint/eslint/issues/21365 ">#21365</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.11.0...v10.13.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint-plugin-prettier` from 5.5.6 to 5.5.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/eslint-plugin-prettier/releases ">eslint-plugin-prettier's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">#796</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
Thanks <a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>!
- Fix fallback diagnostic locations for all supported line endings.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805 ">#805</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
Thanks <a href="https://github.com/JounQin "><code>@JounQin</code></a>!
- Report a clear error when the sync worker fails to load, so a missing
<code>prettier</code> dependency now fails fast with <code>Cannot find
package 'prettier'</code> instead of hanging ESLint indefinitely.</p>
</li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a
href="https://github.com/truongbo17 "><code>@truongbo17</code></a> made
their first contribution in <a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/798 ">prettier/eslint-plugin-prettier#798</a></li>
<li><a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>
made their first contribution in <a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">prettier/eslint-plugin-prettier#796</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 ">https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md ">eslint-plugin-prettier's
changelog</a>.</em></p>
<blockquote>
<h2>5.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796 ">#796</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
Thanks <a
href="https://github.com/OskarEichler "><code>@OskarEichler</code></a>!
- Fix fallback diagnostic locations for all supported line endings.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805 ">#805</a>
<a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
Thanks <a href="https://github.com/JounQin "><code>@JounQin</code></a>!
- Report a clear error when the sync worker fails to load, so a missing
<code>prettier</code> dependency now fails fast with <code>Cannot find
package 'prettier'</code> instead of hanging ESLint indefinitely.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/e6dd27a4e4015748b2e87c646be2c1a530789343 "><code>e6dd27a</code></a>
chore: keep packageManager when cleaning package.json for release (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/808 ">#808</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7544956b642d4e653c235d178432e4d60a312b6b "><code>7544956</code></a>
chore: release eslint-plugin-prettier (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/799 ">#799</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/e3e52386bd8ab1604d4d41ecd961de5e6749eed8 "><code>e3e5238</code></a>
ci: enable npm publish provenance for changesets v3 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/807 ">#807</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7c923c41069c939d6c6c8b7cfcad8f6a266f5276 "><code>7c923c4</code></a>
build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/806 ">#806</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52 "><code>1b7c433</code></a>
fix: bump synckit to surface worker failures instead of hanging (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/805 ">#805</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/a6b3feb3ce5d0bf785ddf4a83d24cf6a5c4bb902 "><code>a6b3feb</code></a>
docs: explain line endings and <code>endOfLine</code> behavior (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/804 ">#804</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/2f6ba1dca350a40857884103a7bf0e74b64901f7 "><code>2f6ba1d</code></a>
ci: exercise the getLocFromIndex ponyfill on ESLint 9 (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/803 ">#803</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/cf1d2c5cffb7520d28fe680603cc4906ada0816f "><code>cf1d2c5</code></a>
chore(deps): update (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/802 ">#802</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/9f14a554f9737b1b985e2b26501d3bb2defac920 "><code>9f14a55</code></a>
chore(deps): update all dependencies (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/788 ">#788</a>)</li>
<li><a
href="https://github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e "><code>7e53ecd</code></a>
fix: map fallback source locations to actual line starts (<a
href="https://redirect.github.com/prettier/eslint-plugin-prettier/issues/796 ">#796</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-optional-chain] safe fix
when the chain ends with a strict null comparison (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12805 ">#12805</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
parenthesize constraint in optional tuple elements (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12995 ">#12995</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unused-vars] ignore type-only
refs for after-used (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12977 ">#12977</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1166ba20e9e484167ebfe216fdb38e605e3f7598 "><code>1166ba2</code></a>
chore(type-utils): detect methods in isTypeReadonly without reading the
inter...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2f0343a694bee1ba9815e4a0f946295452deb082 "><code>2f0343a</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] bound recursive type
trav...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c49d287f046c794133b12fa94207e5ee3b846ddd "><code>c49d287</code></a>
chore: [ci] test on oldest supported TS version (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/13024 ">#13024</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/594fe286ec518c6899a9b89141cf3220bcfb9f72 "><code>594fe28</code></a>
fix(eslint-plugin): [no-unnecessary-condition] false positives on
unresolved ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c6eb98c17cbeee540d3c48d1406098430b2f0660 "><code>c6eb98c</code></a>
feat(eslint-plugin): [await-thenable] add
<code>allowMixedPromiseArrays</code> option (#...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b382b74579e5514c247ed54d0dfc428f3a173f3a "><code>b382b74</code></a>
fix(type-utils): discriminateAnyType crashes when calling getAwaitedType
on a...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79edd896790b031457fc0ca6f81c732b29921c9d "><code>79edd89</code></a>
fix(eslint-plugin): [require-array-sort-compare] ignore extra this type
argum...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.70.1 to 8.72.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.72.1</h2>
<h2>8.72.1 (2026-10-26)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] false
positives on unresolved conditional types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13062 ">#13062</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
bound recursive type traversal instead of catching stack overflows (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13039 ">#13039</a>)</li>
<li><strong>typescript-estree:</strong> use one Program per tsconfig for
the project service in single-run mode (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12988 ">#12988</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Ghoulberg 👻 </li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.72.0</h2>
<h2>8.72.0 (2026-10-19)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> lazy load rules (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13010 ">#13010</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] add
<code>allowMixedPromiseArrays</code> option (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12992 ">#12992</a>)</li>
<li><strong>typescript-estree:</strong> error on abstract keyword that
precedes export (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13019 ">#13019</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> add <code>JSXFragment</code> to
<code>JSXAttribute['value']</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13051 ">#13051</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-readonly-parameter-types]
check where allowed type aliases are declared (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13016 ">#13016</a>)</li>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
properties in object literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12704 ">#12704</a>)</li>
<li><strong>eslint-plugin:</strong> use isTypeLiteralType instead of
type.isLiteral() to include bigint literals on TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13053 ">#13053</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] check
tuples (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13058 ">#13058</a>)</li>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] ignore
extra this type argument on TS < 5.1 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13055 ">#13055</a>)</li>
<li><strong>type-utils:</strong> discriminateAnyType crashes when
calling getAwaitedType on awaited type in TS < 5.0 (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/13054 ">#13054</a>)</li>
<li><strong>typescript-estree:</strong> include leading and trailing
comments & whitespace in Program range (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12991 ">#12991</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Junichiro Kasuya <a
href="https://github.com/jksy "><code>@jksy</code></a></li>
<li>Mitch Fultz <a
href="https://github.com/fitchmultz "><code>@fitchmultz</code></a></li>
<li>Shaan GS <a
href="https://github.com/ShaanGS "><code>@ShaanGS</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.71.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.72.1 (2026-10-26)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.72.0 (2026-10-19)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.2 (2026-10-12)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.2 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.1 (2026-10-05)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.71.0 (2026-09-28)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.71.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4ad6b7553781fa3c93fc26642d7219d2e6624504 "><code>4ad6b75</code></a>
chore(release): publish 8.72.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/77576945345c1537635e617ea0d4b34b003b15ff "><code>7757694</code></a>
chore: cleanup typecheck & build and fix race condition (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/13071 ">#13071</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/a4c2603d3e4fd43b33bc25b82457716e9f7cef71 "><code>a4c2603</code></a>
chore(release): publish 8.72.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7488d681f6e0e96c2aaa1eee9c3d1b9b1ef077cb "><code>7488d68</code></a>
chore(release): publish 8.71.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d57b8da272375b6a45270639894a793933208a91 "><code>d57b8da</code></a>
chore(release): publish 8.71.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8695664c5ee3fbb8fd76907fc45e148579cc3162 "><code>8695664</code></a>
chore(release): publish 8.71.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.9 to 3.9.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases ">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.10</h2>
<ul>
<li>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266 ">#20266</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.10/CHANGELOG.md#3910 ">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md ">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.10</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10 ">diff</a></p>
<h4>Markdown: Update <code>micromark-extension-gfm-table</code> to fix
the table parse issue on performance (<a
href="https://redirect.github.com/prettier/prettier/pull/20266 ">#20266</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<p>See <a
href="https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267 ">https://github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267 </a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/1172b82c295c4f889fd787dc6c78c3e194ebf353 "><code>1172b82</code></a>
Release 3.9.10</li>
<li><a
href="https://github.com/prettier/prettier/commit/d0142273aff2c76f8a69785d42ee2cedc4b0aaa3 "><code>d014227</code></a>
Update <code>micromark-extension-gfm-table</code> to fix the table parse
issue on perfor...</li>
<li><a
href="https://github.com/prettier/prettier/commit/953b9084329dcd06ed1072a04b333f1e6e9371e8 "><code>953b908</code></a>
Bump Prettier dependency to 3.9.9</li>
<li><a
href="https://github.com/prettier/prettier/commit/ad8a6bf4fa23c42fd114683fec43b28a11bd24af "><code>ad8a6bf</code></a>
Clean changelog_unreleased</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.9.9...3.9.10 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.2.13 to 1.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12026 ">#12026</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- fix(core): deliver callbacks once to a handler registered twice by
merged configs</p>
<p>Merging two runnable configs that both carry the same callback
handler, as happens when an agent's <code>streamEvents()</code> runs
inside a LangGraph node with tracing on, registered that handler twice,
so it received every callback twice: every streamed chunk arrived twice.
The configured callback manager now keeps each handler once, in order,
including a handler passed as a plain object of methods that merged
configs wrapped twice.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12042 ">#12042</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): include node <code>metadata</code> in
<code>Graph.toJSON()</code> output when set, matching Python</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/12048 ">#12048</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
Thanks <a href="https://github.com/sera-wi "><code>@sera-wi</code></a>!
- fix(core): escape <code>drawMermaid</code> node metadata labels and
leave out object values, so metadata with brackets or objects no longer
breaks Mermaid parsing</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11986 ">#11986</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2caf64da3f02730f3cd2aab0c15de6eab41a01da "><code>2caf64d</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat: stream tool-call args as <code>tool-call-delta</code> slices</p>
<p>Tool-call and server-tool-call args now stream as
<code>tool-call-delta</code> events, which carry only the new slice of
the args, instead of <code>block-delta</code> snapshots of the args so
far. A large tool call now costs about the same bytes on the wire as the
same length of text.</p>
<ul>
<li>This covers the compat bridge (any model that only implements
<code>_streamResponseChunks</code>), the OpenAI-compatible converter
(OpenAI Completions, Groq, Mistral, IBM, OpenRouter, Perplexity,
DeepSeek, Fireworks, Together AI and xAI Completions), OpenAI and xAI
Responses, Anthropic (client and server tool calls) and Bedrock
Converse. Google and Ollama still send one complete snapshot per
call.</li>
<li>A tool call's <code>id</code>, <code>name</code> and
<code>index</code> go on <code>content-block-start</code>, which carries
no args. An <code>id</code> or <code>name</code> that arrives later
reaches consumers on <code>content-block-finish</code>.</li>
<li>If you read raw events and their <code>block-delta</code>
<code>fields.args</code> mid-stream, or write agent stream transformers
that do, read <code>tool-call-delta</code> instead. <code>await
stream</code>, <code>.toolCalls</code> and the assembled message are
unchanged.</li>
<li>Upgrade your clients first. Older clients mishandle
<code>tool-call-delta</code>. You need
<code>@langchain/langgraph-sdk</code> 1.12.6 or later;
<code>@langchain/react</code>, <code>@langchain/vue</code>,
<code>@langchain/svelte</code> or <code>@langchain/angular</code> 1.2.6
or later; and <code>langchain-core</code> 1.6.13 or later for Python
clients.</li>
<li>To hold back, pin <code>@langchain/core</code> below 1.3.0. That
also keeps you on <code>@langchain/openai</code>,
<code>@langchain/anthropic</code>, <code>@langchain/aws</code> and
<code>@langchain/xai</code> versions that send snapshots.</li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.20</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11922 ">#11922</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d71c542fb1d9cd1ceb310a4759591c024cf0d57d "><code>d71c542</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): add <code>midConversationSystemMessages</code> and
<code>midConversationTools</code> to <code>ModelProfile</code>. They say
whether a chat model sends a system message after the first turn in
place, and whether it can add a tool through a message rather than the
request's tool list. Either way the prompt prefix before it stays
unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.19</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11982 ">#11982</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5af4684bd19a16bb59950801da92245733482fb3 "><code>5af4684</code></a>
Thanks <a
href="https://github.com/richardscarrott "><code>@richardscarrott</code></a>!
- feat(core): read <code>tool-call-delta</code> in
<code>ChatModelStream</code></p>
<ul>
<li><code>ChatModelStream</code> appends <code>tool-call-delta</code>
slices to a tool call's args, and still replaces them on
<code>block-delta</code></li>
<li>It ignores delta types it doesn't recognize instead of throwing
<code>Unknown delta type</code></li>
</ul>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11956 ">#11956</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/93d62b008e13e10f28724a5ab09ab6eda584f1cb "><code>93d62b0</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Require langsmith >=0.11.0 to include the restored NullableHeaders
type declarations.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11822 ">#11822</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d3e6fe66a5f902fa615f076ca71d9541f1291166 "><code>d3e6fe6</code></a>
Thanks <a href="https://github.com/dqbd "><code>@dqbd</code></a>! - Add
explicit agent address support to <code>LangChainTracer</code>, inherit
project and address destinations together, and delegate default
destination resolution to the LangSmith SDK.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11150 ">#11150</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/cea15cf9ef5216125b24f23bb5ad06b7c1a91b33 "><code>cea15cf</code></a>
Thanks <a
href="https://github.com/mdnanocom "><code>@mdnanocom</code></a>! -
fix(core): defer tool call chunk collapsing in AIMessageChunk to fix
O(n²) streaming aggregation</p>
<p><code>AIMessageChunk</code> eagerly re-ran
<code>collapseToolCallChunks</code> in its constructor on every streamed
delta <code>concat</code>, re-parsing all accumulated tool args each
time — O(n²) over a stream, which can block the event loop for seconds
on long tool-call streams. Collapsing now runs lazily, once, on first
read of <code>tool_calls</code> / <code>invalid_tool_calls</code>.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.17</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e8c5dc82ba52cff3bc08cd71f963a69596d7ea4d "><code>e8c5dc8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12047 ">#12047</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/b5135cc189adbf313f4e92c1527f96a40a546977 "><code>b5135cc</code></a>
feat(openai,langchain): support Decisions API and agent middleware (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11930 ">#11930</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/52d2ba8ea50149f2314df63b79582f8508034a3b "><code>52d2ba8</code></a>
fix(aws): use this.caller in ChatBedrockConverse to support retries (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11463 ">#11463</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/178af31ee41b7e36fa2971af61ade6a5460b6d2e "><code>178af31</code></a>
fix(core): deliver callbacks once to a handler registered twice by
merged con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/304d190a30343ecb8ae5f06081a2b5a6d93d9968 "><code>304d190</code></a>
fix(core): make drawMermaid node metadata labels safe (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12048 ">#12048</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/50343ba94c2388b3d3a7d4d6cd0977fa60a90294 "><code>50343ba</code></a>
fix(core): include node metadata in Graph.toJSON() (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12042 ">#12042</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d1d0692d8498d7e1521c854d90af0395535df4d8 "><code>d1d0692</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12044 ">#12044</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/95b191b1928ee8f4e20e51aa821f5c5fd4b8b3da "><code>95b191b</code></a>
feat(openai): refresh model profiles from models.dev (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12046 ">#12046</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/81577b3e84c3f38581e76e8335faa89511e99d74 "><code>81577b3</code></a>
fix(langchain): re-throw a drained tool from the agent's ToolNode (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/12043 ">#12043</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/4cbf0f5938710ce1669c679febdbea41b733a100 "><code>4cbf0f5</code></a>
chore(deps): bump the npm_and_yarn group across 2 directories with 1
update (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.13...@langchain/core@1.3.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.18 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph-api</code><a
href="https://github.com/1 "><code>@1</code></a>.5.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2961 ">#2961</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/1631fd895723c4553345ceb5d9fc425b68bda959 "><code>1631fd8</code></a>
Thanks <a href="https://gith ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:41 -08:00
dependabot[bot]
d05c887163
chore(deps): bump the uv group across 2 directories with 1 update ( #9513 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory: [langgraph-sdk](https://github.com/langchain-ai/langgraph ).
Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple
directory: [langgraph-sdk](https://github.com/langchain-ai/langgraph ).
Updates `langgraph-sdk` from 0.4.4 to 0.4.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.11</h2>
<p>Changes since sdk==0.4.10</p>
<ul>
<li>release(langgraph): 1.2.19 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9504 ">#9504</a>)</li>
<li>release(sdk-py): 0.4.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9503 ">#9503</a>)</li>
<li>test(sdk-py): check that a reconnect loop resumes after the newest
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9483 ">#9483</a>)</li>
<li>fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects
with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9481 ">#9481</a>)</li>
<li>fix(sdk-py): warn when a stream reconnects without a Last-Event-ID
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9482 ">#9482</a>)</li>
<li>fix(sdk-py): preserve SSE data and cursor state across chunks (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9477 ">#9477</a>)</li>
<li>fix(sdk-py): retry failed stream reconnects with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9462 ">#9462</a>)</li>
<li>fix(sdk-py): match Auth.on overload to optional resources (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9450 ">#9450</a>)</li>
<li>fix(sdk-py): reset the reconnect cursor on every empty id (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9440 ">#9440</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.10</h2>
<p>Changes since sdk==0.4.9</p>
<ul>
<li>release(checkpoint): 4.3.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9447 ">#9447</a>)</li>
<li>release(langgraph): 1.2.18 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9445 ">#9445</a>)</li>
<li>release(sdk-py): 0.4.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9446 ">#9446</a>)</li>
<li>fix(sdk-py): retry runs.wait with a bodyless GET and raise run
errors in sync wait (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9399 ">#9399</a>)</li>
<li>fix(sdk-py): follow the SSE spec for multi-line data, empty ids and
a leading BOM (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9402 ">#9402</a>)</li>
<li>fix(sdk-py): accept durability, stream_resumable and context in the
runs overloads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9403 ">#9403</a>)</li>
<li>release(langgraph): 1.2.17 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9418 ">#9418</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.9</h2>
<p>Changes since sdk==0.4.8</p>
<ul>
<li>release(sdk-py): 0.4.9 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9398 ">#9398</a>)</li>
<li>feat(sdk-py): add Priority for thread priority settings (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9392 ">#9392</a>)</li>
<li>chore(deps): remove precautionary third-party upper bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9390 ">#9390</a>)</li>
<li>chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in
/libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9370 ">#9370</a>)</li>
<li>chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in
/libs/cli/js-examples in the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9154 ">#9154</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt
with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9150 ">#9150</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.8</h2>
<p>Changes since sdk==0.4.7</p>
<ul>
<li>release(langgraph): 1.2.16 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9334 ">#9334</a>)</li>
<li>release(sdk-py): 0.4.8 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9335 ">#9335</a>)</li>
<li>fix(sdk-py): surface thread stream errors and stop retrying a
rejected stream (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9317 ">#9317</a>)</li>
<li>release(prebuilt): 1.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9316 ">#9316</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.7</h2>
<p>Changes since sdk==0.4.6</p>
<ul>
<li>release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li>release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li>fix(sdk-py): end a thread stream's run only on a root lifecycle
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9228 ">#9228</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/05e4efe712ae6b9dd9560007395c9ee248f45b1f "><code>05e4efe</code></a>
release(cli): relax api bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6606 ">#6606</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/c80d93c78a6e6223c3df1581f0e70466110fd4b8 "><code>c80d93c</code></a>
fix(cli): Escape variable substitution in compose codegen (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6594 ">#6594</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/87cb5095285ba809b547584d31bae26046fc844a "><code>87cb509</code></a>
feat(checkpoint): Validate checkpointer type at compile time (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6586 ">#6586</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/84023451a2bd5987b1d4df530f4145d503d75ccb "><code>8402345</code></a>
release(langgraph): bump to 1.0.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6582 ">#6582</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/efe78447b3cdd424702274ffda918961af07e560 "><code>efe7844</code></a>
feat(sdk-py): emit id as part of stream events (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6581 ">#6581</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/df191731918482c5eaf2934a2df0c9cb3571db0c "><code>df19173</code></a>
fix: update readme (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6570 ">#6570</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/4d01e69b823c4126f375cbed72fed7c5797d1b91 "><code>4d01e69</code></a>
release(checkpoint-postgres): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6568 ">#6568</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/e86b5f4da21f0fa00bec19fe0e86d031dba0b004 "><code>e86b5f4</code></a>
chore: pgqs (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6567 ">#6567</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b70d5aac0ee330e9dde22ca9c7e8f0774e44da54 "><code>b70d5aa</code></a>
release(checkpoint-sqlite): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6566 ">#6566</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a "><code>2972429</code></a>
fix(checkpoint-sqlite): harden (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6565 ">#6565</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.4...cli==0.4.11 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langgraph-sdk` from 0.4.4 to 0.4.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.11</h2>
<p>Changes since sdk==0.4.10</p>
<ul>
<li>release(langgraph): 1.2.19 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9504 ">#9504</a>)</li>
<li>release(sdk-py): 0.4.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9503 ">#9503</a>)</li>
<li>test(sdk-py): check that a reconnect loop resumes after the newest
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9483 ">#9483</a>)</li>
<li>fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects
with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9481 ">#9481</a>)</li>
<li>fix(sdk-py): warn when a stream reconnects without a Last-Event-ID
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9482 ">#9482</a>)</li>
<li>fix(sdk-py): preserve SSE data and cursor state across chunks (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9477 ">#9477</a>)</li>
<li>fix(sdk-py): retry failed stream reconnects with backoff (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9462 ">#9462</a>)</li>
<li>fix(sdk-py): match Auth.on overload to optional resources (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9450 ">#9450</a>)</li>
<li>fix(sdk-py): reset the reconnect cursor on every empty id (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9440 ">#9440</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.10</h2>
<p>Changes since sdk==0.4.9</p>
<ul>
<li>release(checkpoint): 4.3.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9447 ">#9447</a>)</li>
<li>release(langgraph): 1.2.18 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9445 ">#9445</a>)</li>
<li>release(sdk-py): 0.4.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9446 ">#9446</a>)</li>
<li>fix(sdk-py): retry runs.wait with a bodyless GET and raise run
errors in sync wait (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9399 ">#9399</a>)</li>
<li>fix(sdk-py): follow the SSE spec for multi-line data, empty ids and
a leading BOM (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9402 ">#9402</a>)</li>
<li>fix(sdk-py): accept durability, stream_resumable and context in the
runs overloads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9403 ">#9403</a>)</li>
<li>release(langgraph): 1.2.17 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9418 ">#9418</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.9</h2>
<p>Changes since sdk==0.4.8</p>
<ul>
<li>release(sdk-py): 0.4.9 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9398 ">#9398</a>)</li>
<li>feat(sdk-py): add Priority for thread priority settings (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9392 ">#9392</a>)</li>
<li>chore(deps): remove precautionary third-party upper bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9390 ">#9390</a>)</li>
<li>chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in
/libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9370 ">#9370</a>)</li>
<li>chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in
/libs/cli/js-examples in the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9154 ">#9154</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt
with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9150 ">#9150</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.8</h2>
<p>Changes since sdk==0.4.7</p>
<ul>
<li>release(langgraph): 1.2.16 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9334 ">#9334</a>)</li>
<li>release(sdk-py): 0.4.8 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9335 ">#9335</a>)</li>
<li>fix(sdk-py): surface thread stream errors and stop retrying a
rejected stream (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9317 ">#9317</a>)</li>
<li>release(prebuilt): 1.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9316 ">#9316</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.7</h2>
<p>Changes since sdk==0.4.6</p>
<ul>
<li>release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li>release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li>fix(sdk-py): end a thread stream's run only on a root lifecycle
event (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9228 ">#9228</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>release(langgraph): 1.2.14 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9215 ">#9215</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/05e4efe712ae6b9dd9560007395c9ee248f45b1f "><code>05e4efe</code></a>
release(cli): relax api bounds (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6606 ">#6606</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/c80d93c78a6e6223c3df1581f0e70466110fd4b8 "><code>c80d93c</code></a>
fix(cli): Escape variable substitution in compose codegen (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6594 ">#6594</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/87cb5095285ba809b547584d31bae26046fc844a "><code>87cb509</code></a>
feat(checkpoint): Validate checkpointer type at compile time (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6586 ">#6586</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/84023451a2bd5987b1d4df530f4145d503d75ccb "><code>8402345</code></a>
release(langgraph): bump to 1.0.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6582 ">#6582</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/efe78447b3cdd424702274ffda918961af07e560 "><code>efe7844</code></a>
feat(sdk-py): emit id as part of stream events (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6581 ">#6581</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/df191731918482c5eaf2934a2df0c9cb3571db0c "><code>df19173</code></a>
fix: update readme (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6570 ">#6570</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/4d01e69b823c4126f375cbed72fed7c5797d1b91 "><code>4d01e69</code></a>
release(checkpoint-postgres): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6568 ">#6568</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/e86b5f4da21f0fa00bec19fe0e86d031dba0b004 "><code>e86b5f4</code></a>
chore: pgqs (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6567 ">#6567</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b70d5aac0ee330e9dde22ca9c7e8f0774e44da54 "><code>b70d5aa</code></a>
release(checkpoint-sqlite): 3.0.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6566 ">#6566</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/297242913f8ad2143ee3e2f72e67db0911d48e2a "><code>2972429</code></a>
fix(checkpoint-sqlite): harden (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/6565 ">#6565</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.4...cli==0.4.11 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:37 -08:00
dependabot[bot]
21ab811f91
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 4 updates ( #9523 )
...
Bumps the minor-and-patch group in /libs/checkpoint-conformance with 4
updates: [pytest](https://github.com/pytest-dev/pytest ),
[pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `pytest` from 9.1.1 to 9.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases ">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.2.0</h2>
<h1>pytest 9.2.0 (2026-10-27)</h1>
<h2>Removals and backward incompatible breaking changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14716 ">#14716</a>:
<code>-c</code> now raises a usage error for a path that does not exist,
is a directory, or is in a format pytest has no loader for. Such paths
were previously either ignored or reported as an unhandled
<code>FileNotFoundError</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/8593 ">#8593</a>:
The <code>indirect</code>, <code>ids</code> and <code>scope</code>
arguments of <code>Metafunc.parametrize()
<pytest.Metafunc.parametrize></code> -- and therefore of
<code>@pytest.mark.parametrize <pytest.mark.parametrize
ref></code> -- are now keyword-only.</p>
<p>Passing them positionally was a common source of confusing errors,
e.g. <code>parametrize("arg1", "arg2", [(1,
2)])</code> made the argvalues land in <code>indirect</code> and failed
with <code>indirect fixture '(1, 2)' doesn't exist</code>; such mistakes
now fail with an understandable <code>TypeError</code>. The type
annotations have always declared these arguments as keyword-only.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/993 ">#993</a>:
Plugin import failures at startup are now reported and classified
instead of escaping as a raw traceback with the accidental exit code
<code>1</code>:</p>
<ul>
<li>a plugin that cannot be found -- via <code>-p</code>,
<code>pytest_plugins</code> or <code>PYTEST_PLUGINS</code> -- exits with
<code>pytest.ExitCode</code> <code>USAGE_ERROR</code> (<code>4</code>),
like a <code>conftest.py</code> that fails to import;</li>
<li>a plugin that is found but raises while importing -- including a
broken <code>pytest11</code> entry point or a missing plugin dependency
-- exits with <code>pytest.ExitCode</code> <code>INTERNAL_ERROR</code>
(<code>3</code>), with the traceback preserved.</li>
</ul>
<p><code>pytest.main</code> now returns these codes instead of raising
<code>ImportError</code>. Also fixed an <code>IndexError</code> from
pytest's own internals when the plugin raised an exception with no
arguments.</p>
</li>
</ul>
<h2>Deprecations (removal in next major release)</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14742 ">#14742</a>:
The private <code>_pytest.python.CallSpec2</code> name has been renamed
to <code>CallSpec</code>.
The old <code>CallSpec2</code> alias remains available for now and will
be removed in pytest 10 or 11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14755 ">#14755</a>:
Schedule <em>yield_fixture</em> decorator for removal in pytest 10 or
11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14774 ">#14774</a>:
Similarly to the deprecation of class-scoped fixtures defined as
instance methods in pytest 9.1,
<em>all</em> higher-scoped fixtures (<code>module</code>,
<code>package</code>, and <code>session</code>) defined
as instance methods are now deprecated.</p>
<p>They suffer from the same issue the original deprecation only fixed
for
class-scoped fixtures, see <code>10819</code> and
<code>14011</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14808 ">#14808</a>:
Passing a non-string value to a <code>string</code>-typed ini option now
emits a <code>pytest.PytestRemovedIn10Warning</code>. This affects
<code>[tool.pytest.ini_options]</code> in <code>pyproject.toml</code>.
In pytest 10 this will raise a <code>TypeError</code>, matching the
behavior of the corresponding TOML config path.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/7323 ">#7323</a>:
Passing <code>bytes</code> to <code>TerminalReporter.write_line()</code>
is now deprecated, pass a <code>str</code> instead.</p>
</li>
</ul>
<h2>New features</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14743 ">#14743</a>:
<!-- raw HTML omitted -->Full diff:<!-- raw HTML omitted --> now
contains a legend explaining the <!-- raw HTML omitted -->+<!-- raw HTML
omitted --> & <!-- raw HTML omitted -->-<!-- raw HTML omitted -->
symbols in diff output.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/2781 ">#2781</a>:
When <code>strict_markers</code> is enabled, marker names used in
<code>-m</code> expressions are now validated against registered
markers.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/6881 ">#6881</a>:
Added the <code>parametrize_long_str_id_strategy</code> configuration
option to control how long <code>str</code>/<code>bytes</code> parameter
values are handled in auto-generated test IDs. Explicit IDs set via
<code>ids=[...]</code> or <code>pytest.param(..., id=...)</code> are not
affected. Available strategies: <code>short</code> (default, values over
100 chars fall back to <code>argname+index</code>), <code>sha256</code>
(SHA-256 hex digest), <code>legacy</code> (keep full value), and
<code>disallow</code> (error requesting explicit IDs).</li>
</ul>
<h2>Improvements in existing functionality</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/10745 ">#10745</a>:
A <code>RecursionError</code> whose recursion origin cannot be located
now shows only the
first and last 10 stack frames, matching what pytest already did when
locating
the origin failed outright. Previously the full traceback -- often
around a
thousand near-identical frames -- was rendered, which was both slow and
unreadable. Pass <code>--full-trace</code> to see every frame.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae1d0ff57b8bd4252da9ade7353523ac0ac73281 "><code>ae1d0ff</code></a>
Prepare release version 9.2.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/143ce31dea9b12ff2ab6add04361ee01ab114931 "><code>143ce31</code></a>
pre-commit: exclude codespell on generated release announcements</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/532dc5fc78f57de5115c5ecc9c6c29257787ada7 "><code>532dc5f</code></a>
tox: add attrs dependency to regen, needed in reportingdemo.rst</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a7b2446ee41a7298d3a0bc22c52f3b8bacae1566 "><code>a7b2446</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15245 ">#15245</a>
from pytest-dev/claude/project-thread-9jcf91</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/679d09c6945156746e17e9ec0b1c8309bbde3ad3 "><code>679d09c</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/15266 ">#15266</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/41d12cdbb4a35a7877768d93d8dc50a9117a8d8c "><code>41d12cd</code></a>
docs: clarify typing for yield fixtures</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/b9022ba04a33bfc76b5c9aefb8974755a80bf5ce "><code>b9022ba</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15182 ">#15182</a>
from 1871698/docs/improve-getting-started-description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/16f87a7f364a7362fbfbb204c79a47ad567b4fbd "><code>16f87a7</code></a>
docs: improve getting-started.rst test execution description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/082ed70e314ee8e1ab117763d17fe801648f7508 "><code>082ed70</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15255 ">#15255</a>
from pytest-dev/claude/project-thread-eoi3d6</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae37a013763e9c4a143245eda1acdc3c27961685 "><code>ae37a01</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15227 ">#15227</a>
from pytest-dev/claude/project-thread-4etye4</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-asyncio` from 1.4.0 to 1.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-asyncio/releases ">pytest-asyncio's
releases</a>.</em></p>
<blockquote>
<h2>pytest-asyncio v1.4.1</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.1 ">1.4.1</a>
- 2026-10-25</h1>
<h2>Added</h2>
<ul>
<li>Declared support for Python 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Allow <em>AsyncIterable</em> as a return type for asynchronous
generator fixtures decorated with <em>pytest_asyncio.fixture</em> (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1090 ">#1090</a>)</li>
</ul>
<h2>Notes for Downstream Packagers</h2>
<ul>
<li>Source-tree development dependencies now use PEP 735 dependency
groups and <code>uv.lock</code>. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1518 ">#1518</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/6af7f5c9a8c77fe5040b9d368b9ed01837c25652 "><code>6af7f5c</code></a>
chore: Prepare release of v1.4.1.</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/32ccf64ec115e42543bddb8cd142b2026b0cab77 "><code>32ccf64</code></a>
Support 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/983007120dcc53b14f8f7e9df492cbd1d20a242c "><code>9830071</code></a>
Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1590 ">#1590</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/0238023e439113044a9ed095307884c774ec9e46 "><code>0238023</code></a>
Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1589 ">#1589</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/93893ecd9447d105ebd56419bc5162aa2420587e "><code>93893ec</code></a>
Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/f287e5e0f5425380b24c32b64037dfb2ed3cb937 "><code>f287e5e</code></a>
Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1581 ">#1581</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b71da4fe09265e1ad86d4cbfc452b590ebfc4daa "><code>b71da4f</code></a>
Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1582 ">#1582</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/d8c51d8990a4bbdf8a19ff0cf80d68b95b11dea8 "><code>d8c51d8</code></a>
Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b12808bd8d061b583ccdddc53ad6c85198509eed "><code>b12808b</code></a>
Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1578 ">#1578</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/e0601f0ce9532de0b5453a5cfd08f25b258a93f5 "><code>e0601f0</code></a>
Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1577 ">#1577</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-asyncio/compare/v1.4.0...v1.4.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.9 to 0.17.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>Install ruff 0.17.3</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.17.3</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz ">ruff-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz ">ruff-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip ">ruff-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>0.17.2</h2>
<p>Released on 2026-10-22.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>complexity</code>] Add
<code>unnecessary-regular-expression-compile</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25533 ">#25533</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Avoid syntax errors for type variables with starred constraints
(<code>UP040</code>, <code>UP046</code>, <code>UP047</code>,
<code>RUF053</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28362 ">#28362</a>)</li>
<li>[<code>pydocstyle</code>] Treat backslash-escaped <code>*args</code>
and <code>**kwargs</code> as documented (<code>D417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29536 ">#29536</a>)</li>
<li>[<code>pylint</code>] Avoid false positive on starred elements
(<code>PLE0643</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29483 ">#29483</a>)</li>
<li>[<code>pylint</code>] Mark fixes unsafe when deleting comments
(<code>PLR5501</code>, <code>PLW0120</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29414 ">#29414</a>)</li>
<li>[<code>pyupgrade</code>] Mark fix unsafe when deleting comments
(<code>UP035</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29413 ">#29413</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid intermediate names in lint name resolution (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29506 ">#29506</a>)</li>
<li>Prefilter bidirectional Unicode checks by UTF-8 leading bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29561 ">#29561</a>)</li>
<li>Share postfix parsing and reduce expression copies (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29480 ">#29480</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/ba65abf8ba7bfbcc059f7fb9712be5ba9cab6abc "><code>ba65abf</code></a>
Bump version to 0.17.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29745 ">#29745</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/fb2f9218793e3b0e979175d43d88dcac791e92d6 "><code>fb2f921</code></a>
[ty] Fix narrowing of strings and integers compared with enum members
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29743 ">#29743</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d1812878d5f81af6f5810d193ebc44413d1b21cc "><code>d181287</code></a>
[ty] Index nominal union alternatives (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29196 ">#29196</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/07872adbafa7c00f42f1174d8aa3c3e324033009 "><code>07872ad</code></a>
[ty] Preserve string literals in comparisons with
<code>LiteralString</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29741 ">#29741</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/95888b2edfaa34d0159732856b1466cf53b33e64 "><code>95888b2</code></a>
[ty] Preserve narrowing after guarded match subject captures (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29558 ">#29558</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3c8166b683805aa89557b0739f5b9918ad58ea6d "><code>3c8166b</code></a>
[ty] Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29652 ">#29652</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3fd20e08598ac345b8afd524d3f7086456e4e758 "><code>3fd20e0</code></a>
[ty] Preserve generic callback specializations during return refinement
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29667 ">#29667</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2f0a29ece1f1a539c65c0671c04c76bb886219fe "><code>2f0a29e</code></a>
[ty] Record predicate truthiness alongside expression inference (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29706 ">#29706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/60f104a1a2ec4e980198ff54c38ba6fe7045b29f "><code>60f104a</code></a>
[ty] Honor <a
href="https://github.com/override "><code>@override</code></a> on
overload implementations in stubs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29470 ">#29470</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/207ec3affeb118fce03a65f9333959157e228312 "><code>207ec3a</code></a>
[ty] Add diagnostic baseline support (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27636 ">#27636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.9...0.17.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.84 to 0.0.94
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>Install ty 0.0.94</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.ps1
| iex"
</code></pre>
<h2>Download ty 0.0.94</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz ">ty-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz ">ty-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip ">ty-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip ">ty-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip ">ty-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz ">ty-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz ">ty-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz ">ty-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>0.0.93</h2>
<p>Released on 2026-10-28.</p>
<h3>Preview features</h3>
<ul>
<li>
<p>Add diagnostic baselines to help adopt ty in projects with existing
errors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27636 ">#27636</a>).
Configure a baseline in <code>pyproject.toml</code>:</p>
<pre lang="toml"><code>[tool.ty]
baseline = "ty-baseline.json"
</code></pre>
<p>Run <code>ty check --update-baseline</code> to record existing
diagnostics. Subsequent checks filter matching diagnostics from CLI
output and show them as hints in the language server. The baseline
format may change while the feature is in preview.</p>
</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix a panic when checking truthiness in a loop (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29759 ">#29759</a>)</li>
<li>Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29652 ">#29652</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid synthesizing primary keys for abstract Django models (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29744 ">#29744</a>)</li>
<li>Combine constraints from repeated <code>ParamSpec</code>s (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29172 ">#29172</a>)</li>
<li>Fix narrowing of strings and integers compared with enum members (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29743 ">#29743</a>)</li>
<li>Honor <code>@override</code> on overload implementations in stubs
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29470 ">#29470</a>)</li>
<li>Preserve caller type variables in nested union inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29611 ">#29611</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/f8ea270e0b125116ce52868b16384819183056af "><code>f8ea270</code></a>
Bump version to 0.0.94 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4857 ">#4857</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/7a36fc91318b07a58d0aa27753db4db1d212032a "><code>7a36fc9</code></a>
Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/issues/4853 ">#4853</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3db5e4df7becd3ca55fd06c78e98bf7c8a38e469 "><code>3db5e4d</code></a>
Bump version to 0.0.93 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4842 ">#4842</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f8fd0e8b5ce954b5a7f4e38431d805dd58e50e2d "><code>f8fd0e8</code></a>
Update astral-sh/setup-uv action to v10.3.2 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4843 ">#4843</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/c1ca420006c7e5ef62ddfa16267fd7531a0a1000 "><code>c1ca420</code></a>
Update uv to v0.13.6 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4845 ">#4845</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c5c9079ac053fa3f879ee7625ec5c28a0817de4 "><code>4c5c907</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4844 ">#4844</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/0445d6497ae22a0c480b23807cd71f47889053d8 "><code>0445d64</code></a>
Optimize Linux x86-64 ty releases with LLVM BOLT (<a
href="https://redirect.github.com/astral-sh/ty/issues/4833 ">#4833</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3933e6918b731d86b3f3a4f1bc47f2ce21195e8e "><code>3933e69</code></a>
Bump version to 0.0.92 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4821 ">#4821</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9aaec9ba5896c759e8e93000d0a1dec51f2bae57 "><code>9aaec9b</code></a>
Handle AI policy labels through Actions (<a
href="https://redirect.github.com/astral-sh/ty/issues/4812 ">#4812</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/e1b8efaafd842d3e33c1a21ae7e897434452975b "><code>e1b8efa</code></a>
Update uv to 0.13.5 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4809 ">#4809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.84...0.0.94 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:50:19 -08:00
dependabot[bot]
d42015a707
chore(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 in /libs/langgraph ( #9535 )
...
Bumps [types-requests](https://github.com/python/typeshed ) from
2.33.0.20260906 to 2.33.0.20261006.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits ">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:53 -08:00
dependabot[bot]
93aaa4632c
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 6 updates ( #9529 )
...
Bumps the minor-and-patch group in /libs/checkpoint with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.5`
| `1.7.1` |
| [pytest](https://github.com/pytest-dev/pytest ) | `9.1.1` | `9.2.0` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio ) |
`1.4.0` | `1.4.1` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.16.0` |
`3.17.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.9` | `0.17.3` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.84` | `0.0.94` |
Updates `langchain-core` from 1.6.5 to 1.7.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.7.1</h2>
<p>Changes since langchain-core==1.7.0</p>
<p>release(core): version 1.7.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41548 ">#41548</a>)
fix(core): preserve gateway tracing metadata in v3 streams (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41504 ">#41504</a>)
fix(core): escape node metadata in Mermaid labels (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41512 ">#41512</a>)
chore(deps): bump the minor-and-patch group across 3 directories with 32
updates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41465 ">#41465</a>)
chore(deps-dev): bump setuptools from 83.0.0 to 84.1.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41442 ">#41442</a>)
chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41425 ">#41425</a>)
chore(infra): relax third-party dependency upper bounds (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41407 ">#41407</a>)</p>
<h2>langchain-core==1.7.0</h2>
<p>Changes since langchain-core==1.6.13</p>
<p>release(core): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41418 ">#41418</a>)
feat(core): emit <code>tool-call-delta</code> for streamed tool-call
args (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41257 ">#41257</a>)</p>
<h2>Notes</h2>
<ul>
<li>Tool-call args now stream as <code>tool-call-delta</code> slices
instead of <code>block-delta</code> snapshots of the args so far. If you
read raw stream events and their <code>block-delta</code> args
mid-stream, read <code>tool-call-delta</code> instead.
<code>.tool_calls.get()</code> and <code>.output</code> are unchanged.
To keep snapshots, pin <code>langchain-core<1.7</code>.</li>
<li>Since 1.6.13, iterating <code>ChatModelStream.tool_calls</code>
yields each call's new args slice, not a snapshot of the args so
far.</li>
</ul>
<h2>langchain-core==1.6.13</h2>
<p>Changes since langchain-core==1.6.12</p>
<p>release(core): 1.6.13 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41397 ">#41397</a>)
chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/core
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41373 ">#41373</a>)
feat(core,langchain,standard-tests): read <code>tool-call-delta</code>
in stream consumers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41246 ">#41246</a>)</p>
<h2>langchain-core==1.6.12</h2>
<p>Changes since langchain-core==1.6.11</p>
<p>release(core): 1.6.12 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41277 ">#41277</a>)
fix(core): propagate extras on content-block-start events (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41272 ">#41272</a>)</p>
<h2>langchain-core==1.6.11</h2>
<p>Changes since langchain-core==1.6.10</p>
<p>release(core): 1.6.11 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41260 ">#41260</a>)
feat(core): accept address inside LangChainTracer (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41006 ">#41006</a>)</p>
<h2>langchain-core==1.6.10</h2>
<p>Changes since langchain-core==1.6.9</p>
<p>release(core): 1.6.10 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41220 ">#41220</a>)
feat(core,anthropic,openai): declare mid-conversation support in model
profiles (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41180 ">#41180</a>)</p>
<h2>langchain-core==1.6.9</h2>
<p>Changes since langchain-core==1.6.8</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/6419339aa163a49f32d9b80ff20d6adc3b446d49 "><code>6419339</code></a>
release(core): version 1.7.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41548 ">#41548</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3bc70b9daa0d17f1438ab408df5e9f2a8ba1e56e "><code>3bc70b9</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41543 ">#41543</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/facf2788ae1f60c62f2397d15698237c405a5f05 "><code>facf278</code></a>
fix(core): preserve gateway tracing metadata in v3 streams (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41504 ">#41504</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/6eb169b56cea0b535b9af0ca504bb367f6407455 "><code>6eb169b</code></a>
release(anthropic): 1.7.7 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41538 ">#41538</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/0808e17e29b59ee1cc45a5ce2aa4cb4006671c1c "><code>0808e17</code></a>
fix(anthropic): trace resolved reasoning effort (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41536 ">#41536</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4b80abeadd6faf7f321ac5d690602812f82a3baf "><code>4b80abe</code></a>
fix(core): escape node metadata in Mermaid labels (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41512 ">#41512</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/abbc0c30b9a3396a748add260284c27c8f5fb09f "><code>abbc0c3</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41520 ">#41520</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/575db57ab3658e38ba1d8c40c2bf62110c8a0c27 "><code>575db57</code></a>
test(openai): use current lightweight model in integration tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41509 ">#41509</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/0d29456babaa707357523ea20b27bd8858fb4766 "><code>0d29456</code></a>
release(openai): 1.7.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41506 ">#41506</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8635846e620acc59ca0273944eaef2f4889452a3 "><code>8635846</code></a>
chore(model-profiles): refresh openai model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/41505 ">#41505</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.5...langchain-core==1.7.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest` from 9.1.1 to 9.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases ">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.2.0</h2>
<h1>pytest 9.2.0 (2026-10-27)</h1>
<h2>Removals and backward incompatible breaking changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14716 ">#14716</a>:
<code>-c</code> now raises a usage error for a path that does not exist,
is a directory, or is in a format pytest has no loader for. Such paths
were previously either ignored or reported as an unhandled
<code>FileNotFoundError</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/8593 ">#8593</a>:
The <code>indirect</code>, <code>ids</code> and <code>scope</code>
arguments of <code>Metafunc.parametrize()
<pytest.Metafunc.parametrize></code> -- and therefore of
<code>@pytest.mark.parametrize <pytest.mark.parametrize
ref></code> -- are now keyword-only.</p>
<p>Passing them positionally was a common source of confusing errors,
e.g. <code>parametrize("arg1", "arg2", [(1,
2)])</code> made the argvalues land in <code>indirect</code> and failed
with <code>indirect fixture '(1, 2)' doesn't exist</code>; such mistakes
now fail with an understandable <code>TypeError</code>. The type
annotations have always declared these arguments as keyword-only.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/993 ">#993</a>:
Plugin import failures at startup are now reported and classified
instead of escaping as a raw traceback with the accidental exit code
<code>1</code>:</p>
<ul>
<li>a plugin that cannot be found -- via <code>-p</code>,
<code>pytest_plugins</code> or <code>PYTEST_PLUGINS</code> -- exits with
<code>pytest.ExitCode</code> <code>USAGE_ERROR</code> (<code>4</code>),
like a <code>conftest.py</code> that fails to import;</li>
<li>a plugin that is found but raises while importing -- including a
broken <code>pytest11</code> entry point or a missing plugin dependency
-- exits with <code>pytest.ExitCode</code> <code>INTERNAL_ERROR</code>
(<code>3</code>), with the traceback preserved.</li>
</ul>
<p><code>pytest.main</code> now returns these codes instead of raising
<code>ImportError</code>. Also fixed an <code>IndexError</code> from
pytest's own internals when the plugin raised an exception with no
arguments.</p>
</li>
</ul>
<h2>Deprecations (removal in next major release)</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14742 ">#14742</a>:
The private <code>_pytest.python.CallSpec2</code> name has been renamed
to <code>CallSpec</code>.
The old <code>CallSpec2</code> alias remains available for now and will
be removed in pytest 10 or 11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14755 ">#14755</a>:
Schedule <em>yield_fixture</em> decorator for removal in pytest 10 or
11.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14774 ">#14774</a>:
Similarly to the deprecation of class-scoped fixtures defined as
instance methods in pytest 9.1,
<em>all</em> higher-scoped fixtures (<code>module</code>,
<code>package</code>, and <code>session</code>) defined
as instance methods are now deprecated.</p>
<p>They suffer from the same issue the original deprecation only fixed
for
class-scoped fixtures, see <code>10819</code> and
<code>14011</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14808 ">#14808</a>:
Passing a non-string value to a <code>string</code>-typed ini option now
emits a <code>pytest.PytestRemovedIn10Warning</code>. This affects
<code>[tool.pytest.ini_options]</code> in <code>pyproject.toml</code>.
In pytest 10 this will raise a <code>TypeError</code>, matching the
behavior of the corresponding TOML config path.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/7323 ">#7323</a>:
Passing <code>bytes</code> to <code>TerminalReporter.write_line()</code>
is now deprecated, pass a <code>str</code> instead.</p>
</li>
</ul>
<h2>New features</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14743 ">#14743</a>:
<!-- raw HTML omitted -->Full diff:<!-- raw HTML omitted --> now
contains a legend explaining the <!-- raw HTML omitted -->+<!-- raw HTML
omitted --> & <!-- raw HTML omitted -->-<!-- raw HTML omitted -->
symbols in diff output.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/2781 ">#2781</a>:
When <code>strict_markers</code> is enabled, marker names used in
<code>-m</code> expressions are now validated against registered
markers.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/6881 ">#6881</a>:
Added the <code>parametrize_long_str_id_strategy</code> configuration
option to control how long <code>str</code>/<code>bytes</code> parameter
values are handled in auto-generated test IDs. Explicit IDs set via
<code>ids=[...]</code> or <code>pytest.param(..., id=...)</code> are not
affected. Available strategies: <code>short</code> (default, values over
100 chars fall back to <code>argname+index</code>), <code>sha256</code>
(SHA-256 hex digest), <code>legacy</code> (keep full value), and
<code>disallow</code> (error requesting explicit IDs).</li>
</ul>
<h2>Improvements in existing functionality</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/10745 ">#10745</a>:
A <code>RecursionError</code> whose recursion origin cannot be located
now shows only the
first and last 10 stack frames, matching what pytest already did when
locating
the origin failed outright. Previously the full traceback -- often
around a
thousand near-identical frames -- was rendered, which was both slow and
unreadable. Pass <code>--full-trace</code> to see every frame.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae1d0ff57b8bd4252da9ade7353523ac0ac73281 "><code>ae1d0ff</code></a>
Prepare release version 9.2.0</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/143ce31dea9b12ff2ab6add04361ee01ab114931 "><code>143ce31</code></a>
pre-commit: exclude codespell on generated release announcements</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/532dc5fc78f57de5115c5ecc9c6c29257787ada7 "><code>532dc5f</code></a>
tox: add attrs dependency to regen, needed in reportingdemo.rst</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a7b2446ee41a7298d3a0bc22c52f3b8bacae1566 "><code>a7b2446</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15245 ">#15245</a>
from pytest-dev/claude/project-thread-9jcf91</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/679d09c6945156746e17e9ec0b1c8309bbde3ad3 "><code>679d09c</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/15266 ">#15266</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/41d12cdbb4a35a7877768d93d8dc50a9117a8d8c "><code>41d12cd</code></a>
docs: clarify typing for yield fixtures</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/b9022ba04a33bfc76b5c9aefb8974755a80bf5ce "><code>b9022ba</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15182 ">#15182</a>
from 1871698/docs/improve-getting-started-description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/16f87a7f364a7362fbfbb204c79a47ad567b4fbd "><code>16f87a7</code></a>
docs: improve getting-started.rst test execution description</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/082ed70e314ee8e1ab117763d17fe801648f7508 "><code>082ed70</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15255 ">#15255</a>
from pytest-dev/claude/project-thread-eoi3d6</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ae37a013763e9c4a143245eda1acdc3c27961685 "><code>ae37a01</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/15227 ">#15227</a>
from pytest-dev/claude/project-thread-4etye4</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-asyncio` from 1.4.0 to 1.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-asyncio/releases ">pytest-asyncio's
releases</a>.</em></p>
<blockquote>
<h2>pytest-asyncio v1.4.1</h2>
<h1><a
href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.1 ">1.4.1</a>
- 2026-10-25</h1>
<h2>Added</h2>
<ul>
<li>Declared support for Python 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Allow <em>AsyncIterable</em> as a return type for asynchronous
generator fixtures decorated with <em>pytest_asyncio.fixture</em> (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1090 ">#1090</a>)</li>
</ul>
<h2>Notes for Downstream Packagers</h2>
<ul>
<li>Source-tree development dependencies now use PEP 735 dependency
groups and <code>uv.lock</code>. (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1518 ">#1518</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/6af7f5c9a8c77fe5040b9d368b9ed01837c25652 "><code>6af7f5c</code></a>
chore: Prepare release of v1.4.1.</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/32ccf64ec115e42543bddb8cd142b2026b0cab77 "><code>32ccf64</code></a>
Support 3.15 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1588 ">#1588</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/983007120dcc53b14f8f7e9df492cbd1d20a242c "><code>9830071</code></a>
Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1590 ">#1590</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/0238023e439113044a9ed095307884c774ec9e46 "><code>0238023</code></a>
Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1589 ">#1589</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/93893ecd9447d105ebd56419bc5162aa2420587e "><code>93893ec</code></a>
Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1583 ">#1583</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/f287e5e0f5425380b24c32b64037dfb2ed3cb937 "><code>f287e5e</code></a>
Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1581 ">#1581</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b71da4fe09265e1ad86d4cbfc452b590ebfc4daa "><code>b71da4f</code></a>
Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1582 ">#1582</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/d8c51d8990a4bbdf8a19ff0cf80d68b95b11dea8 "><code>d8c51d8</code></a>
Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1580 ">#1580</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/b12808bd8d061b583ccdddc53ad6c85198509eed "><code>b12808b</code></a>
Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1578 ">#1578</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-asyncio/commit/e0601f0ce9532de0b5453a5cfd08f25b258a93f5 "><code>e0601f0</code></a>
Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (<a
href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1577 ">#1577</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-asyncio/compare/v1.4.0...v1.4.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.16.0 to 3.17.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.17.0</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/641 ">#641</a>:
Failures of mock assertions such as <code>assert_called_with</code> are
again reported only once, instead of two or three times with the
original error from the <code>mock</code> module chained before
them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/642 ">#642</a>:
Mock assertion failures no longer show misleading introspection when
they are not about the arguments of the last call:
<code>assert_called</code>, <code>assert_called_once</code>,
<code>assert_not_called</code>, <code>assert_any_call</code>, their
<code>await</code> counterparts, and
<code>assert_called_once_with</code>/<code>assert_awaited_once_with</code>
when the mock was not called (awaited) exactly once. The introspection
also no longer reports arguments passed by position versus by keyword as
different for autospecced mocks, and no longer shows empty
<code>Args:</code>/<code>Kwargs:</code> sections when assertion
rewriting is not available.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/643 ">#643</a>:
<code>assert_has_calls</code> and <code>assert_has_awaits</code>
failures no longer show pytest introspection, which compared the
expected and actual calls position by position and so reported
differences between unrelated calls. The mock's own message, listing the
expected and actual calls, is still shown.</li>
</ul>
<h2>v3.16.1</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/617 ">#617</a>:
Fixed <code>assert_has_calls</code> raising <code>ValueError</code>
instead of <code>AssertionError</code> (or showing misleading
introspection) when the expected calls are plain tuples rather than
<code>call(...)</code> objects, such as <code>(args, kwargs)</code>
entries of another mock's <code>call_args_list</code>,
<code>(args,)</code>, <code>(kwargs,)</code>, <code>(name, args)</code>
or <code>(name, kwargs)</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/621 ">#621</a>:
Fixed <code>mocker.stop()</code> sometimes stopping the wrong mock, for
example with mocks from <code>mocker.create_autospec</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/621 ">#621</a>:
<code>mocker.stop()</code> now undoes the most recent patch first when
the same object is used in several patches.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/623 ">#623</a>:
Fixed misleading introspection in <code>assert_has_awaits</code>
failures, and
<code>assert_has_calls</code>/<code>assert_has_awaits</code> raising
<code>IndexError</code> instead of <code>AssertionError</code> when
<code>calls</code> is passed by keyword.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/624 ">#624</a>:
Clear <code>spy_return_iter</code> after a spied synchronous or
asynchronous function raises, matching <code>spy_return</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/627 ">#627</a>:
Document <code>async_stub</code> await assertions and the distinction
between call and await tracking.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/629 ">#629</a>:
Fixed <code>mocker.resetall()</code> skipping the mocks patched with
<code>mocker.patch.multiple()</code>, both the ones it creates and the
ones passed explicitly.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/630 ">#630</a>:
<code>mocker.resetall()</code> now also resets <code>spy_return</code>
and <code>spy_exception</code> of spies, like it already did for
<code>spy_return_list</code> and <code>spy_return_iter</code>, and no
longer overwrites attributes with these names on mocks that are not
spies.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/633 ">#633</a>:
Fixed spies on <code>classmethod</code>, <code>staticmethod</code>,
builtins and classes returning a <code>MagicMock</code> instead of
calling the spied code after
<code>mocker.resetall(side_effect=True)</code>. Resetting a spy's
<code>side_effect</code> now goes back to calling the spied code, also
clearing any <code>side_effect</code> set on the spy.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.17.0</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><code>[#641 ](https://github.com/pytest-dev/pytest-mock/issues/641 )
<https://github.com/pytest-dev/pytest-mock/pull/641> ;</code>_:
Failures of mock assertions such as <code>assert_called_with</code> are
again reported only once, instead of two or three times with the
original error from the <code>mock</code> module chained before
them.</li>
<li><code>[#642 ](https://github.com/pytest-dev/pytest-mock/issues/642 )
<https://github.com/pytest-dev/pytest-mock/pull/642> ;</code>_: Mock
assertion failures no longer show misleading introspection when they are
not about the arguments of the last call: <code>assert_called</code>,
<code>assert_called_once</code>, <code>assert_not_called</code>,
<code>assert_any_call</code>, their <code>await</code> counterparts, and
<code>assert_called_once_with</code>/<code>assert_awaited_once_with</code>
when the mock was not called (awaited) exactly once. The introspection
also no longer reports arguments passed by position versus by keyword as
different for autospecced mocks, and no longer shows empty
<code>Args:</code>/<code>Kwargs:</code> sections when assertion
rewriting is not available.</li>
<li><code>[#643 ](https://github.com/pytest-dev/pytest-mock/issues/643 )
<https://github.com/pytest-dev/pytest-mock/pull/643> ;</code>_:
<code>assert_has_calls</code> and <code>assert_has_awaits</code>
failures no longer show pytest introspection, which compared the
expected and actual calls position by position and so reported
differences between unrelated calls. The mock's own message, listing the
expected and actual calls, is still shown.</li>
</ul>
<h2>3.16.1</h2>
<p><em>2026-10-17</em></p>
<ul>
<li><code>[#617 ](https://github.com/pytest-dev/pytest-mock/issues/617 )
<https://github.com/pytest-dev/pytest-mock/pull/617> ;</code>_:
Fixed <code>assert_has_calls</code> raising <code>ValueError</code>
instead of <code>AssertionError</code> (or showing misleading
introspection) when the expected calls are plain tuples rather than
<code>call(...)</code> objects, such as <code>(args, kwargs)</code>
entries of another mock's <code>call_args_list</code>,
<code>(args,)</code>, <code>(kwargs,)</code>, <code>(name, args)</code>
or <code>(name, kwargs)</code>.</li>
<li><code>[#621 ](https://github.com/pytest-dev/pytest-mock/issues/621 )
<https://github.com/pytest-dev/pytest-mock/pull/621> ;</code>_:
Fixed <code>mocker.stop()</code> sometimes stopping the wrong mock, for
example with mocks from <code>mocker.create_autospec</code>.</li>
<li><code>[#621 ](https://github.com/pytest-dev/pytest-mock/issues/621 )
<https://github.com/pytest-dev/pytest-mock/pull/621> ;</code>_:
<code>mocker.stop()</code> now undoes the most recent patch first when
the same object is used in several patches.</li>
<li><code>[#623 ](https://github.com/pytest-dev/pytest-mock/issues/623 )
<https://github.com/pytest-dev/pytest-mock/pull/623> ;</code>_:
Fixed misleading introspection in <code>assert_has_awaits</code>
failures, and
<code>assert_has_calls</code>/<code>assert_has_awaits</code> raising
<code>IndexError</code> instead of <code>AssertionError</code> when
<code>calls</code> is passed by keyword.</li>
<li><code>[#624 ](https://github.com/pytest-dev/pytest-mock/issues/624 )
<https://github.com/pytest-dev/pytest-mock/pull/624> ;</code>_:
Clear <code>spy_return_iter</code> after a spied synchronous or
asynchronous function raises, matching <code>spy_return</code>.</li>
<li><code>[#627 ](https://github.com/pytest-dev/pytest-mock/issues/627 )
<https://github.com/pytest-dev/pytest-mock/pull/627> ;</code>_:
Document <code>async_stub</code> await assertions and the distinction
between call and await tracking.</li>
<li><code>[#629 ](https://github.com/pytest-dev/pytest-mock/issues/629 )
<https://github.com/pytest-dev/pytest-mock/pull/629> ;</code>_:
Fixed <code>mocker.resetall()</code> skipping the mocks patched with
<code>mocker.patch.multiple()</code>, both the ones it creates and the
ones passed explicitly.</li>
<li><code>[#630 ](https://github.com/pytest-dev/pytest-mock/issues/630 )
<https://github.com/pytest-dev/pytest-mock/pull/630> ;</code>_:
<code>mocker.resetall()</code> now also resets <code>spy_return</code>
and <code>spy_exception</code> of spies, like it already did for
<code>spy_return_list</code> and <code>spy_return_iter</code>, and no
longer overwrites attributes with these names on mocks that are not
spies.</li>
<li><code>[#633 ](https://github.com/pytest-dev/pytest-mock/issues/633 )
<https://github.com/pytest-dev/pytest-mock/pull/633> ;</code>_:
Fixed spies on <code>classmethod</code>, <code>staticmethod</code>,
builtins and classes returning a <code>MagicMock</code> instead of
calling the spied code after
<code>mocker.resetall(side_effect=True)</code>. Resetting a spy's
<code>side_effect</code> now goes back to calling the spied code, also
clearing any <code>side_effect</code> set on the spy.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/5c2f207ca7098dde996f9bedd06e596e39b6246b "><code>5c2f207</code></a>
Release 3.17.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/96252715fad4a0dfec1997103cc231bc1f133616 "><code>9625271</code></a>
Bump the minor version for releases that change existing behavior</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/34b87aeeef1d2a85be5ce4fadb0c6bc4a033c40a "><code>34b87ae</code></a>
Drop introspection from assert_has_calls and assert_has_awaits (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/643 ">#643</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/866520f2d339c7649af56ac227ca67ed36b1e92e "><code>866520f</code></a>
Only show introspection for failures about the call arguments (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/642 ">#642</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/5ab41c143c57842456caad0029082e919fa6a95d "><code>5ab41c1</code></a>
Do not chain the original mock error to wrapped assertion failures (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/641 ">#641</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/1916b14db224b893edf18251f26a38487eb0d6a6 "><code>1916b14</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/635 ">#635</a>
from nicoddemus/docs-contributing-resetall</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/212fcd903aeb685a3b39875be82fc84ff58ebc56 "><code>212fcd9</code></a>
Document resetall, the changelog format and running tests with tox</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9374b2c3e38e3bbc2e04328f7026ae3680f0476f "><code>9374b2c</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/634 ">#634</a>
from pytest-dev/release-3.16.1</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/fab730daf4a4cfc260d8656b0467503131535a00 "><code>fab730d</code></a>
Release 3.16.1</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/d26d41bb01e99de5c0b59156c667d46985b03470 "><code>d26d41b</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/627 ">#627</a>
from xiehuanyi/docs/async-stub-awaits-20261012-r2</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.16.0...v3.17.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.9 to 0.17.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>Install ruff 0.17.3</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.17.3</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz ">ruff-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz ">ruff-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip ">ruff-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.17.3</h2>
<p>Released on 2026-10-26.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>suspicious</code>] Add <code>shared-clock-mock</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29074 ">#29074</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>pyupgrade</code>] Avoid incorrect conversions to f-strings
(<code>UP032</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25485 ">#25485</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Buffer stdout in <code>ruff format</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29631 ">#29631</a>)</li>
<li>Specialize ASCII identifier lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29503 ">#29503</a>)</li>
<li>Speed up identifier and keyword lexing (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29463 ">#29463</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>flake8-bandit</code>] Describe what the rule actually checks
for <code>httpx</code> (<code>S113</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27936 ">#27936</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/itsvedantkumar "><code>@itsvedantkumar</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
</ul>
<h2>0.17.2</h2>
<p>Released on 2026-10-22.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>complexity</code>] Add
<code>unnecessary-regular-expression-compile</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25533 ">#25533</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Avoid syntax errors for type variables with starred constraints
(<code>UP040</code>, <code>UP046</code>, <code>UP047</code>,
<code>RUF053</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28362 ">#28362</a>)</li>
<li>[<code>pydocstyle</code>] Treat backslash-escaped <code>*args</code>
and <code>**kwargs</code> as documented (<code>D417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29536 ">#29536</a>)</li>
<li>[<code>pylint</code>] Avoid false positive on starred elements
(<code>PLE0643</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29483 ">#29483</a>)</li>
<li>[<code>pylint</code>] Mark fixes unsafe when deleting comments
(<code>PLR5501</code>, <code>PLW0120</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29414 ">#29414</a>)</li>
<li>[<code>pyupgrade</code>] Mark fix unsafe when deleting comments
(<code>UP035</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29413 ">#29413</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid intermediate names in lint name resolution (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29506 ">#29506</a>)</li>
<li>Prefilter bidirectional Unicode checks by UTF-8 leading bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29561 ">#29561</a>)</li>
<li>Share postfix parsing and reduce expression copies (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29480 ">#29480</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/ba65abf8ba7bfbcc059f7fb9712be5ba9cab6abc "><code>ba65abf</code></a>
Bump version to 0.17.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29745 ">#29745</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/fb2f9218793e3b0e979175d43d88dcac791e92d6 "><code>fb2f921</code></a>
[ty] Fix narrowing of strings and integers compared with enum members
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29743 ">#29743</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d1812878d5f81af6f5810d193ebc44413d1b21cc "><code>d181287</code></a>
[ty] Index nominal union alternatives (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29196 ">#29196</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/07872adbafa7c00f42f1174d8aa3c3e324033009 "><code>07872ad</code></a>
[ty] Preserve string literals in comparisons with
<code>LiteralString</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29741 ">#29741</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/95888b2edfaa34d0159732856b1466cf53b33e64 "><code>95888b2</code></a>
[ty] Preserve narrowing after guarded match subject captures (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29558 ">#29558</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3c8166b683805aa89557b0739f5b9918ad58ea6d "><code>3c8166b</code></a>
[ty] Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29652 ">#29652</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/3fd20e08598ac345b8afd524d3f7086456e4e758 "><code>3fd20e0</code></a>
[ty] Preserve generic callback specializations during return refinement
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/29667 ">#29667</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2f0a29ece1f1a539c65c0671c04c76bb886219fe "><code>2f0a29e</code></a>
[ty] Record predicate truthiness alongside expression inference (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29706 ">#29706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/60f104a1a2ec4e980198ff54c38ba6fe7045b29f "><code>60f104a</code></a>
[ty] Honor <a
href="https://github.com/override "><code>@override</code></a> on
overload implementations in stubs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/29470 ">#29470</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/207ec3affeb118fce03a65f9333959157e228312 "><code>207ec3a</code></a>
[ty] Add diagnostic baseline support (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27636 ">#27636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.9...0.17.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.84 to 0.0.94
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>Install ty 0.0.94</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-installer.ps1
| iex"
</code></pre>
<h2>Download ty 0.0.94</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz ">ty-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz ">ty-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip ">ty-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip ">ty-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip ">ty-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz ">ty-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz ">ty-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz ">ty-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/ty/releases/download/0.0.94/ty-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.94</h2>
<p>Released on 2026-10-28.</p>
<h3>Bug fixes</h3>
<ul>
<li>Correctly handle line continuation when fixing unused ignore
comments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29781 ">#29781</a>)</li>
<li>Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/pull/4853 ">#4853</a>)</li>
<li>Fix a panic when a comprehension filter depends on a later binding
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29786 ">#29786</a>)</li>
<li>Fix a panic when sorting diagnostics without a source location (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29780 ">#29780</a>)</li>
<li>Fix panic on a chained assignment with a missing value (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29787 ">#29787</a>)</li>
<li>Reject defaulted TypeVars after a TypeVarTuple in legacy generic
classes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29753 ">#29753</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Django: suppress invalid-override errors for <code>Meta</code>
configurations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29769 ">#29769</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<h2>0.0.93</h2>
<p>Released on 2026-10-28.</p>
<h3>Preview features</h3>
<ul>
<li>
<p>Add diagnostic baselines to help adopt ty in projects with existing
errors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27636 ">#27636</a>).
Configure a baseline in <code>pyproject.toml</code>:</p>
<pre lang="toml"><code>[tool.ty]
baseline = "ty-baseline.json"
</code></pre>
<p>Run <code>ty check --update-baseline</code> to record existing
diagnostics. Subsequent checks filter matching diagnostics from CLI
output and show them as hints in the language server. The baseline
format may change while the feature is in preview.</p>
</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix a panic when checking truthiness in a loop (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29759 ">#29759</a>)</li>
<li>Fix hang when negating recursive unions of instance types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29652 ">#29652</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid synthesizing primary keys for abstract Django models (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29744 ">#29744</a>)</li>
<li>Combine constraints from repeated <code>ParamSpec</code>s (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29172 ">#29172</a>)</li>
<li>Fix narrowing of strings and integers compared with enum members (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29743 ">#29743</a>)</li>
<li>Honor <code>@override</code> on overload implementations in stubs
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/29470 ">#29470</a>)</li>
<li>Preserve caller type variables in nested union inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/29611 ">#29611</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/f8ea270e0b125116ce52868b16384819183056af "><code>f8ea270</code></a>
Bump version to 0.0.94 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4857 ">#4857</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/7a36fc91318b07a58d0aa27753db4db1d212032a "><code>7a36fc9</code></a>
Fix Linux x86-64 startup on older kernels (<a
href="https://redirect.github.com/astral-sh/ty/issues/4853 ">#4853</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3db5e4df7becd3ca55fd06c78e98bf7c8a38e469 "><code>3db5e4d</code></a>
Bump version to 0.0.93 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4842 ">#4842</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f8fd0e8b5ce954b5a7f4e38431d805dd58e50e2d "><code>f8fd0e8</code></a>
Update astral-sh/setup-uv action to v10.3.2 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4843 ">#4843</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/c1ca420006c7e5ef62ddfa16267fd7531a0a1000 "><code>c1ca420</code></a>
Update uv to v0.13.6 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4845 ">#4845</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c5c9079ac053fa3f879ee7625ec5c28a0817de4 "><code>4c5c907</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4844 ">#4844</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/0445d6497ae22a0c480b23807cd71f47889053d8 "><code>0445d64</code></a>
Optimize Linux x86-64 ty releases with LLVM BOLT (<a
href="https://redirect.github.com/astral-sh/ty/issues/4833 ">#4833</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3933e6918b731d86b3f3a4f1bc47f2ce21195e8e "><code>3933e69</code></a>
Bump version to 0.0.92 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4821 ">#4821</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9aaec9ba5896c759e8e93000d0a1dec51f2bae57 "><code>9aaec9b</code></a>
Handle AI policy labels through Actions (<a
href="https://redirect.github.com/astral-sh/ty/issues/4812 ">#4812</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/e1b8efaafd842d3e33c1a21ae7e897434452975b "><code>e1b8efa</code></a>
Update uv to 0.13.5 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4809 ">#4809</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.84...0.0.94 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:41 -08:00
dependabot[bot]
f8812e50a5
chore(deps-dev): bump pycryptodome from 3.23.0 to 4.2.0 in /libs/checkpoint in the major group ( #9531 )
...
Bumps the major group in /libs/checkpoint with 1 update:
[pycryptodome](https://github.com/Legrandin/pycryptodome ).
Updates `pycryptodome` from 3.23.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/releases ">pycryptodome's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0 - Jura</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<h2>v4.1.0 - Issy-les-Moulineaux</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version compiled for them and with 4-way SHA-3 is used: compared
to the portable version, key generation and verification are 30-45%
faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204), hedged (default) or deterministic,
with an optional context. The new <code>MLDSAMuHash</code> computes the
message representative mu (external mu), to sign or verify a large
message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes, to hash a whole message with a single call, like
<code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up to 1
KiB, it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane
at a time, two rounds per iteration, which needs fewer registers: SHA-3
and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8 <code>OneAsymmetricKey</code> version
2 (RFC 5958), if present, matches the private key. Before, it was
ignored.</li>
</ul>
<h2>v4.0.1 - Le Havre</h2>
<h2>New features</h2>
<ul>
<li>The Windows wheels for x86-64 are built with <code>clang-cl</code>
(compatible with MSVC), so the
code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and
the other
Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big
integers of RSA,
DSA and the NIST curves. To build from source with
<code>clang-cl</code>, set the environment
variable <code>PYCRYPTODOME_CLANG_CL</code> (see the installation
instructions).</li>
</ul>
<h2>v4.0.0 - Grenoble</h2>
<p>Major release, with some breaking changes. See Changelog.</p>
<h2>v3.24.1 - Frejus</h2>
<h2>Resolved issues</h2>
<ul>
<li>Security: the time to create an ECDSA, EdDSA or DSA signature
depended
on the secret nonce, enough to recover the private key with a lattice
attack.
DSA signing is now about 40% slower with GMP. Thanks to Daniel
Bleichenbacher.</li>
</ul>
<h2>v3.24.0 - Evreux</h2>
<p>New features</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst ">pycryptodome's
changelog</a>.</em></p>
<blockquote>
<p>4.2.0 (24 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<p>4.1.0 (19 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version
compiled for them and with 4-way SHA-3 is used: compared to the portable
version,
key generation and verification are 30-45% faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204),
hedged (default) or deterministic, with an optional context.
The new <code>MLDSAMuHash</code> computes the message representative mu
(external mu),
to sign or verify a large message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes,
to hash a whole message with a single call,
like <code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up
to 1 KiB,
it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE
and KangarooTwelve) processes the state one plane at a time, two rounds
per iteration,
which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8
<code>OneAsymmetricKey</code> version 2 (RFC 5958), if present, matches
the private key.
Before, it was ignored.</li>
</ul>
<p>4.0.1 (17 October 2026)
++++++++++++++++++++++++++</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/fba5867dc8f46e1100b2b9438e0ca7c09f0d5fa7 "><code>fba5867</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/52a8ff62cff5c390091ef30834bc7ae8f1a4f7eb "><code>52a8ff6</code></a>
Fix PyPy wheels on Windows with setuptools 84.2</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/5a6f04770d72ed158b4157847de39b0a93728479 "><code>5a6f047</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9865be1158315cf7b4d077437b4a90d6c8086b11 "><code>9865be1</code></a>
Don't run portable python with cffi</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9c642f06a8220387a3381d745abdfb2d1e483e61 "><code>9c642f0</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c40f64ba91b54e225740f11de6e3014dacd25d49 "><code>c40f64b</code></a>
Merge branch 'mlkem_import_export'</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/e9f74ecfca36e4b4b79ece354388b51d31f2f489 "><code>e9f74ec</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/83f1406ad321158c6f3a7a85e95c21e38f99f68e "><code>83f1406</code></a>
Fix icons</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/00f2277e648334c1e42d41cc7c85cf7d17f14e0a "><code>00f2277</code></a>
Add logo</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c4b4328c5218f1cf9c5de722b1cefad3db582a30 "><code>c4b4328</code></a>
Fix docs</li>
<li>Additional commits viewable in <a
href="https://github.com/Legrandin/pycryptodome/compare/v3.23.0...v4.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:48:19 -08:00
dependabot[bot]
5608dfb71e
chore(deps-dev): bump pycryptodome from 3.23.0 to 4.2.0 in /libs/langgraph in the major group ( #9534 )
...
Bumps the major group in /libs/langgraph with 1 update:
[pycryptodome](https://github.com/Legrandin/pycryptodome ).
Updates `pycryptodome` from 3.23.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/releases ">pycryptodome's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0 - Jura</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<h2>v4.1.0 - Issy-les-Moulineaux</h2>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version compiled for them and with 4-way SHA-3 is used: compared
to the portable version, key generation and verification are 30-45%
faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204), hedged (default) or deterministic,
with an optional context. The new <code>MLDSAMuHash</code> computes the
message representative mu (external mu), to sign or verify a large
message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes, to hash a whole message with a single call, like
<code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up to 1
KiB, it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE and KangarooTwelve) processes the state one plane
at a time, two rounds per iteration, which needs fewer registers: SHA-3
and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8 <code>OneAsymmetricKey</code> version
2 (RFC 5958), if present, matches the private key. Before, it was
ignored.</li>
</ul>
<h2>v4.0.1 - Le Havre</h2>
<h2>New features</h2>
<ul>
<li>The Windows wheels for x86-64 are built with <code>clang-cl</code>
(compatible with MSVC), so the
code for CPUs with AVX2, BMI2 and ADX is also used on Windows: SHA-3 and
the other
Keccak-based functions, KangarooTwelve, ChaCha20, Salsa20, and the big
integers of RSA,
DSA and the NIST curves. To build from source with
<code>clang-cl</code>, set the environment
variable <code>PYCRYPTODOME_CLANG_CL</code> (see the installation
instructions).</li>
</ul>
<h2>v4.0.0 - Grenoble</h2>
<p>Major release, with some breaking changes. See Changelog.</p>
<h2>v3.24.1 - Frejus</h2>
<h2>Resolved issues</h2>
<ul>
<li>Security: the time to create an ECDSA, EdDSA or DSA signature
depended
on the secret nonce, enough to recover the private key with a lattice
attack.
DSA signing is now about 40% slower with GMP. Thanks to Daniel
Bleichenbacher.</li>
</ul>
<h2>v3.24.0 - Evreux</h2>
<p>New features</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst ">pycryptodome's
changelog</a>.</em></p>
<blockquote>
<p>4.2.0 (24 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLKEM</code>, for ML-KEM keys
(FIPS 203).
It is based on the portable C code of
<code>mlkem-native
<https://github.com/pq-code-package/mlkem-native> ;</code>_
(v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2
(with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.</li>
<li>New module <code>Crypto.PublicKey.Hybrid</code>, to model hybrid
keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines
ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they
cannot be exported or imported.</li>
<li><code>Crypto.Protocol.HPKE</code> accepts ML-KEM keys and X-Wing
keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK
modes.</li>
</ul>
<p>4.1.0 (19 October 2026)
++++++++++++++++++++++++++</p>
<h2>New features</h2>
<ul>
<li>New module <code>Crypto.PublicKey.MLDSA</code>, for ML-DSA keys
(FIPS 204).
It is based on the portable C code of <code>mldsa-native
<https://github.com/pq-code-package/mldsa-native> ;</code>_
(v2.0.0), with the Keccak code of PyCryptodome. On CPUs with AVX2 and
BMI2, a version
compiled for them and with 4-way SHA-3 is used: compared to the portable
version,
key generation and verification are 30-45% faster, signing 15-30%.</li>
<li>New module <code>Crypto.Signature.mldsa</code>, for ML-DSA and
HashML-DSA signatures (FIPS 204),
hedged (default) or deterministic, with an optional context.
The new <code>MLDSAMuHash</code> computes the message representative mu
(external mu),
to sign or verify a large message in pieces.</li>
<li>New function <code>digest()</code> in the modules of the SHA-2 and
SHA-3 hashes,
to hash a whole message with a single call,
like <code>Crypto.Hash.KangarooTwelve.digest()</code>. For messages up
to 1 KiB,
it is 1.5x to 3.4x faster than <code>new()</code> followed by
<code>digest()</code>.</li>
<li><code>Crypto.IO.PKCS8.wrap()</code> has a new parameter
<code>public_key</code>, to create a <code>OneAsymmetricKey</code>
version 2 (RFC 5958) with the field <code>publicKey</code>.
<code>Crypto.IO.PKCS8.unwrap()</code> returns an
<code>UnwrappedKey</code>: still a tuple <code>(oid, private_key,
params)</code>,
with the same items as attributes, plus <code>public_key</code> (the
field <code>publicKey</code>, if present).</li>
<li>The scalar Keccak permutation (used by SHA-3, SHAKE, cSHAKE, KMAC,
TupleHash, TurboSHAKE
and KangarooTwelve) processes the state one plane at a time, two rounds
per iteration,
which needs fewer registers: SHA-3 and SHAKE are 5-10% faster.</li>
</ul>
<h2>Resolved issues</h2>
<ul>
<li><code>Crypto.PublicKey.ECC.import_key()</code> checks that the field
<code>publicKey</code> of a PKCS#8
<code>OneAsymmetricKey</code> version 2 (RFC 5958), if present, matches
the private key.
Before, it was ignored.</li>
</ul>
<p>4.0.1 (17 October 2026)
++++++++++++++++++++++++++</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/fba5867dc8f46e1100b2b9438e0ca7c09f0d5fa7 "><code>fba5867</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/52a8ff62cff5c390091ef30834bc7ae8f1a4f7eb "><code>52a8ff6</code></a>
Fix PyPy wheels on Windows with setuptools 84.2</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/5a6f04770d72ed158b4157847de39b0a93728479 "><code>5a6f047</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9865be1158315cf7b4d077437b4a90d6c8086b11 "><code>9865be1</code></a>
Don't run portable python with cffi</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/9c642f06a8220387a3381d745abdfb2d1e483e61 "><code>9c642f0</code></a>
Update Changelog</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c40f64ba91b54e225740f11de6e3014dacd25d49 "><code>c40f64b</code></a>
Merge branch 'mlkem_import_export'</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/e9f74ecfca36e4b4b79ece354388b51d31f2f489 "><code>e9f74ec</code></a>
Bump version</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/83f1406ad321158c6f3a7a85e95c21e38f99f68e "><code>83f1406</code></a>
Fix icons</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/00f2277e648334c1e42d41cc7c85cf7d17f14e0a "><code>00f2277</code></a>
Add logo</li>
<li><a
href="https://github.com/Legrandin/pycryptodome/commit/c4b4328c5218f1cf9c5de722b1cefad3db582a30 "><code>c4b4328</code></a>
Fix docs</li>
<li>Additional commits viewable in <a
href="https://github.com/Legrandin/pycryptodome/compare/v3.23.0...v4.2.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:47:40 -08:00
dependabot[bot]
ab350fd5a4
chore(deps): bump langgraph-sdk from 0.4.5 to 0.4.6 in /libs/cli ( #9514 )
...
Bumps [langgraph-sdk](https://github.com/langchain-ai/langgraph ) from
0.4.5 to 0.4.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.6</h2>
<p>Changes since sdk==0.4.5</p>
<ul>
<li>release(sdk-py): 0.4.6 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9214 ">#9214</a>)</li>
<li>fix(sdk-py): percent-encode thread_id and assistant_id in thread
stream requests (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9213 ">#9213</a>)</li>
<li>release(langgraph): 1.2.13 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9205 ">#9205</a>)</li>
<li>chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5
updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9149 ">#9149</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9134 ">#9134</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/ade3f372a5be9e9e9b52db22f128fc501fb72e3d "><code>ade3f37</code></a>
0.4.6</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/bece43dc67024bcd0d4d7649323df3104f56949c "><code>bece43d</code></a>
Fix</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/913b8d5e9547d78523e75304d473555d7347546f "><code>913b8d5</code></a>
Lint</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3c0d9346c278f628ad1b340f4579eef63e08dda6 "><code>3c0d934</code></a>
Add sync test</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/0ebb78d9b202782d65da35e03619c9f65e19d532 "><code>0ebb78d</code></a>
Fix</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/70153ceba22013d34b51317cd76c976a62af80cb "><code>70153ce</code></a>
Fix exception handling for imperative tasks</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/a9c87ed8b64efc6152b4b86a014d2f4cd327cae1 "><code>a9c87ed</code></a>
prebuilt: release 0.2.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4801 ">#4801</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/837fe59e243aa51a7ac361c3cb4cc53d8e542c68 "><code>837fe59</code></a>
prebuilt: support provider builtin tools in
<code>create_react_agent</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4800 ">#4800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/aff3be03dcd5b8ce0fdebde71997295e87b96f61 "><code>aff3be0</code></a>
prebuilt: release 0.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4793 ">#4793</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/10c6ed73205f23cf134833b6f4e56cd4e38de8f0 "><code>10c6ed7</code></a>
Code review</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.5...0.4.6 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-11-01 16:46:09 -08:00
hari-dhanushkodi
e5c961d7fb
fix(cli): remove outdated deploy private-beta notice ( #9506 )
2026-10-30 20:26:39 -04:00
Elior Nataf Lackritz
5bd231cbfd
release(langgraph): 1.2.19 ( #9504 )
...
Bumps langgraph from 1.2.18 to 1.2.19.
Includes:
- List a `ToolNode`'s tool names in its `get_graph()` node metadata
(#9449 )
- Apply a node's `trace_policy` to tracers only, so it no longer changes
what streams see (#9486 )
- Give `messages` and `tools` events the namespace of the graph they ran
in (#9458 )
- Stream messages a node returns from a graph streamed inside another
node (#9463 )
- Respect `subgraphs=False` in `RemoteGraph.stream` when the parent
streams subgraphs (#9453 )
- Stop reporting a tool paused on `interrupt()` as failed on the `tools`
stream (#9406 )
- Return an awaited `@task`'s value while streaming instead of `None`
(#9407 )
2026-10-30 18:14:31 -04:00
Elior Nataf Lackritz
3eaf06c67c
release(checkpoint-sqlite): 3.1.3 ( #9505 )
...
Bumps langgraph-checkpoint-sqlite from 3.1.2 to 3.1.3.
Includes:
- Require `langgraph-checkpoint>=4.3.1`, which rejects NUL bytes in
namespace labels (#9383 )
`checkpoint==4.3.1` is already on PyPI.
2026-10-30 18:14:27 -04:00
Elior Nataf Lackritz
6fab323753
release(sdk-py): 0.4.11 ( #9503 )
...
Bumps the Python SDK version from 0.4.10 to 0.4.11.
Includes:
- Reset the reconnect cursor on every empty SSE `id`, including a
`Last-Event-ID` the caller passed in (#9440 )
- Let `Auth.on()` type-check with no resources or `resources=None`
(#9450 )
- Retry a stream reconnect that fails to open (429, 5xx, transport
error) with backoff (#9462 )
- Keep SSE data and cursor state across chunks (#9477 )
- Retry `runs.wait`, `runs.join` and `runs.cancel(wait=True)` reconnects
with backoff (#9481 )
- Warn when a stream reconnects without a `Last-Event-ID` (#9482 )
2026-10-30 18:14:22 -04:00
Elior Nataf Lackritz
8d5637b2dd
fix(langgraph): keep trace_policy from rewriting streamed node payloads ( #9486 )
...
A node's `trace_policy` was applied to every callback handler on the
node's run, not only to tracers. `RunnableSeq` passed the processed
input and output to `on_chain_start` and `on_chain_end`, so LangGraph's
stream handlers received them too. With `process_outputs=omit_payload`,
messages a node returned never reached `stream_mode="messages"`. With
`process_inputs=omit_payload`, messages a node passed through were
emitted again, because the dedupe never saw them. `astream_events`
reported the node's input and output as `{}`.
`RunnableSeq` now takes the `TracePolicy` itself, in place of
`trace_outputs`, and `PregelNode` passes it there instead of through
`trace_inputs` and `trace_outputs`. When the policy changes the payload,
the run's start and end events go out in two dispatches under one run
id: tracers (`BaseTracer` handlers, `LangChainTracer` included) get the
processed payload, and every other handler gets the real one: the stream
handlers behind the `messages` and `tools` stream modes,
`astream_events` and `astream_log`, and any handler a user adds. Tracers
never receive the unprocessed payload, at start, where `LangChainTracer`
posts the run, or at end. Integrations whose handlers are not
`BaseTracer`s, such as Langfuse's or MLflow's, now get the real payload
too, since the policy exists to keep tracer ingest small. As before, a
processor that raises is logged and the raw payload is recorded. Child
runs still attach to the node's run, since both dispatches use the same
run id and children inherit every handler. Tracers get the end first;
langchain-core shields each `on_chain_end` dispatch once it starts, so a
cancellation can only skip the other handlers' end, never the tracers'.
Errors still reach every handler in one dispatch. With no policy, or a
processor that returns the same object it was given (like the
pass-through policy `create_agent` puts on middleware nodes), every
handler gets the payload in one dispatch, as before. `trace_inputs` is
unchanged; the functional API uses it so every handler, `astream_events`
included, sees `@task` arguments by name.
LangGraph now decides what a stream handler is in one place, by
inheritance from `_StreamingCallbackHandler`: the payload split, the
output taps in `RunnableSeq.stream` and `astream`, and Pregel's choice
to run nodes with `astream` all use it. A handler that only defines the
tap methods used to be tapped and saw the node's raw streamed output; it
no longer gets the taps.
Three new tests in `tests/test_trace_policy.py` run a node that calls a
chat model under a policy and a `FakeTracer`, through sync `stream` and
async `astream` with `stream_mode="messages"`, and through
`astream_events`. The two `messages` tests check that the node's own
message is streamed and the passed-through input is not re-emitted; the
`astream_events` test checks that the node's start and end events carry
the real input and output. All three check that the tracer's node run
holds exactly what the policy returned and that the model run is its
child (on Python 3.11+ for the async tests, since on 3.10 a model called
from a sync node on the async path is not traced at all). All three fail
on main. Two more tests check that a custom handler with the tap methods
gets the real payload and none of the node's streamed output while a
tracer next to it gets the processed one, through `ainvoke` and
`astream_events` (this fails on main too), and that a run cancelled as
the node ends still closes the tracer's node run. The existing trace
policy tests pass unchanged.
Thanks @digit50 for the report and the root-cause analysis.
Fixes #9090
2026-10-30 20:58:19 +00:00
Elior Nataf Lackritz
1f0cf816d5
fix(langgraph): give messages and tools events the namespace of their graph ( #9458 )
...
Fixes #6373
Fixes #5674
`messages` and `tools` events should stream under the namespace of the
graph they ran in, and a stream without `subgraphs=True` should get only
its own graph's events, plus those of a graph that one of its nodes
streams itself. langchain-ai/langgraphjs#3121 applies these rules in JS.
Python broke them in four places:
- **`@task` calls.** A task call nests its checkpoint namespace segment
under its caller's, although it runs in the caller's graph. The handlers
dropped only the last segment, so a model or tool called in a task
looked like a subgraph's: without `subgraphs=True` its events were
dropped, so a functional API agent streamed no tokens (#6373 ), and with
it they came under the calling node's namespace, one level deeper per
nested call. The handlers now also drop one segment per enclosing task
call, read from the task's `langgraph_path`. Send tasks and plain nodes
are unchanged.
- **A graph that runs outside the caller's task.** A graph invoked
inside a node with its own `thread_id`, `checkpoint_ns` or
`checkpoint_id`, or through a LangChain runnable called with its own
`configurable` (which replaces the caller's), starts its namespace at
the root, so a handler inherited from the caller streamed its events as
the caller's own, even with `subgraphs=False` (#5674 ). Such a graph now
drops the `messages` and `tools` handlers it inherits, whatever their
`subgraphs`, so its events stay out of the caller's stream like its
`updates` and `custom` output. A node that streams it still gets its
events.
- **A graph a node streams after running another.** The loop numbers the
namespace of every subgraph a task runs after its first (`node:<id>|1`),
but the handlers read their own namespace before that, so the node got
none of that graph's events. They now read it from the loop.
- **`push_message`.** It kept the pushing node's own segment, ignored
`subgraphs=False`, and reached only the first messages handler, so a
node that streamed a graph never got that graph's pushed messages. It
now follows the same rules, for every messages handler.
Reading the namespace from the loop changes one more case: a root run
given a subgraph's config, with its `checkpoint_ns` (as
`get_state(subgraphs=True)` returns it), took that namespace as its own
and streamed the subgraph's tokens with `subgraphs=False`. The loop runs
it at the root, so it now streams the subgraph node's returned messages,
like any root run.
`stream_events(version="v3")` reads the same namespaces, so a task's
tokens and tool calls and a root node's pushed messages now show in the
run's `messages` and `tool_calls` projections, where they were missing.
The new tests in `test_stream_namespaces.py` fail on `main`, except two
guards that invoke a child graph with no config. No existing test
changed.
Thanks @sdole and @Kannndev for the reports, @lxingy3 for the smaller
repro and diagnosis on #5674 , and @roydonsequeira for the review that
caught the `subgraphs=True` case and the 3.10 failure.
## Release note
`messages` and `tools` events from a `@task` now stream without
`subgraphs=True`, as events of the graph that called the task, so a
functional API agent's `messages` stream carries its tokens. With
`subgraphs=True` they move from the calling node's namespace, such as
`("workflow:<id>",)`, to their graph's, `()` at the root. A graph
invoked inside a node with its own `thread_id`, `checkpoint_ns` or
`checkpoint_id`, or through a runnable called with its own
`configurable`, no longer streams into the caller's `messages` or
`tools` stream, even when the caller passes `subgraphs=True`; a node
that streams it still gets its events. A node that streams a graph after
running another one now gets that graph's events. Messages sent with
`push_message` stream under the namespace of their graph, stay out of a
stream without `subgraphs=True` when they come from a subgraph, and
reach a node that streams their graph. A root run given a subgraph's
`checkpoint_ns` with `subgraphs=False` now streams that subgraph node's
returned messages instead of its tokens. The `stream_mode` chunks that
`astream_events` carries change the same way; its own events do not.
2026-10-30 15:07:34 -04:00
Elior Nataf Lackritz
6f2df053f4
test(sdk-py): check that a reconnect loop resumes after the newest event ( #9483 )
...
Follow-up to the review on #9482 : with `stream_resumable=True`, does a
loop of reconnects replay events? Each reconnect sends the newest event
id the stream got, and a failed reconnect keeps that id for the next
one, so the server replays only what the client missed. The existing
loop tests served the same events whatever the cursor, so nothing
checked this.
`test_*_reconnect_loop_resumes_after_the_newest_event` checks the
`Last-Event-ID` of every request in two loops, sync and async: progress
between drops, and a 502 between two reconnects. A stream that kept its
first cursor, or dropped it after a failed reconnect, fails it.
2026-10-29 15:08:20 -04:00
Elior Nataf Lackritz
ffc3336367
fix(sdk-py): retry runs.wait, join and cancel(wait=True) reconnects with backoff ( #9481 )
...
`runs.wait`, `runs.join` and `runs.cancel(wait=True)` reconnect to the
run's `Location` when the response is cut off, but with no delay: a 429,
a 5xx or a refused connection on the reconnect raised at once, and a
dropped body reconnected again immediately, so they could not ride out a
server restart or a deploy. #9462 fixed the same for streams.
The reconnect now waits with the stream path's backoff and retries those
failures within the same five attempts; any other status and a failed
first request still raise. Each attempt is one GET with
`reconnect_limit=0`, so the loop owns every retry (the join `Location`
points back at itself, so nothing is lost by not following it).
`request_reconnect` raises plain `httpx.HTTPStatusError`, so it checks
429 and 5xx directly, the same set the stream path catches as
`RateLimitError` and `InternalServerError`.
`test_wait_retries_a_failed_reconnect_after_a_backoff` covers each
failure, sync and async, and fails on `main`; the other two new tests
check the budget and that a 404 still raises. `no_sleep` moves to
`conftest.py` so both test files can use it.
2026-10-28 18:55:31 -04:00
Elior Nataf Lackritz
5f4b28a9f7
fix(sdk-py): warn when a stream reconnects without a Last-Event-ID ( #9482 )
...
A dropped stream reconnects even when it has no event id to resume from
(a run created without `stream_resumable=True`, or one that dropped
before its first event). The reconnect can't replay what was sent while
it was disconnected, so those events were lost without a sign.
The SDK now warns when a reconnect request carries no `Last-Event-ID`,
whether the cursor would come from the stream's ids or from the caller's
own header. It still reconnects: everything sent after the reconnect
arrives, so refusing would turn a gap into losing the rest of the
stream.
The new table test covers a stream with no ids (warns; fails on `main`),
one with ids and one with a caller cursor (no warning), sync and async.
The empty-id tests now expect the warning, since they reconnect without
a cursor too.
2026-10-28 18:44:56 -04:00
dependabot[bot]
5c96bce8d3
chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/langgraph ( #9433 )
...
Bumps [setuptools](https://github.com/pypa/setuptools ) from 83.0.0 to
84.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/setuptools/blob/main/NEWS.rst ">setuptools's
changelog</a>.</em></p>
<blockquote>
<h1>v84.1.0</h1>
<h2>Features</h2>
<ul>
<li><code>setuptools.archive_util</code> now raises the new
<code>UnsafeMember</code> exception when
an archive member would be extracted outside of the extraction
directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding
a
quietly incomplete extraction, and matches the behavior of the standard
library's <code>tarfile</code> extraction filters.</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>Wheel.install_as_egg</code> no longer creates namespace package
directories
outside of the destination egg directory. Entries in a wheel's
<code>namespace_packages.txt</code> were split on <code>.</code> and
passed straight to
<code>os.path.join</code>, so an entry that was absolute,
drive-qualified, or UNC
discarded the destination and placed an <code>__init__.py</code> at a
path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.</p>
<p>This code path is reached only by the deprecated
<code>setup_requires</code>
mechanism when <code>setup()</code> is invoked outside a PEP 517
frontend; the
setuptools build backend never reaches it.</p>
</li>
<li>
<p><code>setuptools.archive_util</code> no longer extracts archive
members outside of the
requested extraction directory. Both the tar and zip formats specify
<code>/</code> as
the only path separator, but the guard against <code>..</code>
components split member
names on <code>/</code> alone, so a name such as
<code>..\escaped.txt</code> was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC
prefix
are now rejected on every platform, as are members whose resolved
destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.</p>
</li>
</ul>
<h1>v84.0.0</h1>
<h2>Features</h2>
<ul>
<li>Newline-separated <code>keywords</code> and
<code>platforms</code><code>pypa/setuptools#4887</code><code>old
specification <https://peps.python.org/pep-0345/> ;</code>_
separated items with spaces and the current one uses commas. (<a
href="https://redirect.github.com/pypa/setuptools/issues/4887 ">#4887</a>)</li>
<li><code>Extension</code><code>pypa/distutils#373</code><a
href="https://redirect.github.com/pypa/setuptools/issues/5022 ">#5022</a>)</li>
<li>The C compiler modules now emit log messages through their own
<code>compilers.C.*</code> loggers instead of the distutils root logger,
part of decoupling the compilers package from distutils. The logger
names are normalized to a stable <code>compilers.C.*</code> prefix so
they remain constant as the package migrates toward a standalone
<code>compilers.C</code> distribution. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5266 ">#5266</a>)</li>
<li>The C compilers gained a <code>Compiler.call</code> method -- a thin
wrapper over <code>subprocess.check_call</code> (with macOS
deployment-target env injection) that is the modern replacement for
<code>Compiler.spawn</code>. The compilers no longer depend on
<code>distutils.spawn</code>, <code>distutils.dir_util</code>,
<code>distutils.file_util</code>, <code>distutils._modified</code>, or
<code>distutils.util.execute</code>/<code>split_quoted</code>: the
generic <code>newer</code>/<code>newer_group</code> and
<code>split_quoted</code> helpers are vendored into the
<code>compilers</code> package, and
<code>Compiler.mkpath</code>/<code>move_file</code>/<code>execute</code>
are implemented directly on the standard library
(<code>os.makedirs</code>/<code>shutil.move</code>). The methods are
retained for backward compatibility. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5267 ">#5267</a>)</li>
<li>The compilers no longer depend on <code>distutils.util</code>,
<code>distutils.version</code>, <code>distutils.compat</code>, or
<code>distutils._macos_compat</code>. The platform-identification
helpers
(<code>get_platform</code>/<code>get_host_platform</code>/<code>is_mingw</code>)
now live in <code>distutils.compilers.platform.detect</code> and the
macOS deployment-target logic and <code>compiler_fixup</code> in
<code>distutils.compilers.platform.macos</code>;
<code>CygwinCCompiler.gcc_version</code> returns a
<code>packaging.version.Version</code>. <code>distutils.util</code>
re-exports the platform/macOS helpers from their new homes for backward
compatibility rather than keeping duplicate copies. (sysconfig lookups
still route through distutils pending its own decoupling.) (<a
href="https://redirect.github.com/pypa/setuptools/issues/5268 ">#5268</a>)</li>
<li>The compilers now read their build configuration from the standard
library's <code>sysconfig</code> instead of
<code>distutils.sysconfig</code>. Per-compiler customization --
previously <code>distutils.sysconfig.customize_compiler</code> -- has
moved into <code>Compiler.configure_system()</code>: a no-op on the base
class, with <code>UnixCCompiler</code> applying the
compiler/flag/archiver settings CPython recorded in
<code>sysconfig</code> (and the usual
<code>CC</code>/<code>CFLAGS</code>/<code>LDSHARED</code>/… environment
overrides). <code>distutils.sysconfig.customize_compiler</code> is
retained as a thin wrapper that calls
<code>compiler.configure_system()</code>. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5269 ">#5269</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/setuptools/commit/77b7ace0aaf660beeb9b3f9da4aabf21cbcf3fa9 "><code>77b7ace</code></a>
Bump version: 84.0.0 → 84.1.0</li>
<li><a
href="https://github.com/pypa/setuptools/commit/e66004c64eaf6cf2f8c53ccdfac75cf7abce7ccf "><code>e66004c</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5329 ">#5329</a>
from pypa/fix/wheel-namespace-path-escape</li>
<li><a
href="https://github.com/pypa/setuptools/commit/54b5dcadc1bd938a5a66919e8ab7bcd59805e7fd "><code>54b5dca</code></a>
Cover the containment check with a symlink escape test</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af "><code>6d07b8d</code></a>
Validate namespace package names during legacy wheel installation</li>
<li><a
href="https://github.com/pypa/setuptools/commit/8419f006d4e34c4ecfc7a0bd1bc6993855adc3cc "><code>8419f00</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5356 ">#5356</a>
from pypa/skeleton-ruff-0.16</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6dadc86a3f7dbe1cf49c6301548ffde61d4e74e1 "><code>6dadc86</code></a>
Remove DTZ011 suppressions that Ruff 0.17 reports as unused.</li>
<li><a
href="https://github.com/pypa/setuptools/commit/715ec38b46424533806195a96983e3dd70fdf3b9 "><code>715ec38</code></a>
Merge <a
href="https://github.com/jaraco/skeleton ">https://github.com/jaraco/skeleton </a></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9695460ebfa879ada16545d62b26b9a489a6d5ed "><code>9695460</code></a><code>jaraco/skeleton#219</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9e0812976b1154a7aece47188814385c887bc6c9 "><code>9e08129</code></a><code>jaraco/skeleton#216</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/4e612f9e44ecfad130d0b2a27a2dce0740599b4b "><code>4e612f9</code></a>
Ignore PyPy's deprecated check_home warning in tests</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-29 03:03:53 +09:00
2f46bb3ca4
fix(sdk-py): preserve SSE data and cursor state across chunks ( #9477 )
...
Replaces https://github.com/langchain-ai/langgraph/pull/9451 , which
GitHub would not reopen after the branch was rebased. Prior discussion
and review remain on that PR.
Preserve empty data lines and unnamed null events, emit CR-terminated
lines immediately, and retain decoded cursor IDs across reconnects.
Replace malformed UTF-8 consistently with JS, expose decoder state
through its constructor/read-only property, and suppress repeated
control placeholders.
Rebased onto the current reconnect/backoff fixes without changing
request header encoding, retry parsing, JSON-only payloads or tolerant
EOF behavior. Matching JS changes:
https://github.com/langchain-ai/langgraphjs/pull/3128 .
### SSE references
- [MDN event stream format and
fields](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events#event_stream_format ):
UTF-8, comments, colonless fields and multiline data.
- [WHATWG
parsing](https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream ):
CR/LF/CRLF framing and buffering.
- [WHATWG
interpretation](https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation ):
BOM, data assembly and ID rules.
- [WHATWG
reconnection](https://html.spec.whatwg.org/multipage/server-sent-events.html#sse-processing-model ):
cursor propagation.
Native Python/JS JSON semantics remain language-specific; this does not
claim exhaustive conformance.
## References
-
[Plan](https://openswe.langchain.dev/agents/86db0ac8-b177-5c04-a1e5-e3226a37b42e/plan )
- [Slack
thread](https://langchain.slack.com/archives/C0C411URFR6/p1792789247110279 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/86db0ac8-b177-5c04-a1e5-e3226a37b42e )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Hunter Lovell <hntrl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-28 10:53:22 -07:00
dependabot[bot]
4b7f2f5230
chore(deps): bump zod from 4.3.6 to 4.6.7 in /libs/cli/js-monorepo-example ( #9431 )
...
Bumps [zod](https://github.com/colinhacks/zod ) from 4.3.6 to 4.6.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases ">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.7</h2>
<h2>Commits:</h2>
<ul>
<li>b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7</li>
</ul>
<h2>v4.6.6</h2>
<blockquote>
<p>Six malicious commits pushed to <code>main</code> on September 21
with a compromised git credential were reverted the same day in <a
href="https://redirect.github.com/colinhacks/zod/issues/6620 ">#6620</a>
and have since been removed from the history of <code>main</code>. None
were ever published to npm. The npm provenance for 4.6.6 names 284243fb,
the pre-rewrite copy of 9c219833 with identical contents.</p>
</blockquote>
<h2>Commits:</h2>
<ul>
<li>0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale
directly in Zod Mini</li>
<li>9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from
zod/locales, not z.locales</li>
<li>34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales
tree-shaking note</li>
<li>74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions
instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to
bronze sponsors</li>
<li>8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for
Japan logo and list it first in bronze</li>
<li>bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for
Japan logo to match the other bronze tiles</li>
<li>c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on
the release-approval environment until the staged versions are approved
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6638 ">#6638</a>)</li>
<li>a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record
output and input as members, not base type arguments (<a
href="https://redirect.github.com/colinhacks/zod/issues/6645 ">#6645</a>)</li>
<li>a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set
and map size bounds before parsing elements (<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li>529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6</li>
<li>9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a
failed OIDC token exchange says why</li>
</ul>
<h2>v4.6.5</h2>
<h2>Commits:</h2>
<ul>
<li>d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch
highlights to the 4.6 post</li>
<li>f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch
highlights into the 4.6 post's own sections</li>
<li>de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties
section with the check and add a Zod Mini tab (<a
href="https://redirect.github.com/colinhacks/zod/issues/6598 ">#6598</a>)</li>
<li>56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the
.properties() shape off the instance type (<a
href="https://redirect.github.com/colinhacks/zod/issues/6600 ">#6600</a>)</li>
<li>ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add
z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)"</li>
<li>cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert
"feat: add z.currencyCode() over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)""</li>
<li>0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5</li>
<li>59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the
integration peers to the workspace zod after the 4.6.5 bump</li>
</ul>
<h2>v4.6.4</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.3 ">4.6.3</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/d6bc1e30 "><code>d6bc1e30</code></a>
feat: add <code>z.currencyCode()</code> over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/pull/6595 ">#6595</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/ad32d751 "><code>ad32d751</code></a>
perf: <code>z.url()</code> rejects an invalid URL with
<code>URL.canParse()</code> instead of a throwing constructor, about 50x
faster; fewer allocations on the validation path (<a
href="https://redirect.github.com/colinhacks/zod/pull/6588 ">#6588</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/2bb08717 "><code>2bb08717</code></a>
chore: re-pin the integration peers to the workspace zod after the 4.6.4
bump</li>
<li><a
href="https://github.com/colinhacks/zod/commit/f6e1701a "><code>f6e1701a</code></a>
chore(deps): bump next to 15.5.25 and vite to 7.3.6 (<a
href="https://redirect.github.com/colinhacks/zod/pull/6153 ">#6153</a>)</li>
</ul>
<h2>v4.6.3</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.2 ">4.6.2</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/413cce9a "><code>413cce9a</code></a>
fix(v4): make z.properties() a check again (<a
href="https://redirect.github.com/colinhacks/zod/pull/6594 ">#6594</a>) —
removes the standalone <code>z.properties()</code> schema from 4.6.0;
<code>z.instanceof().properties()</code> and
<code>.check(...z.properties())</code> are unchanged</li>
<li><a
href="https://github.com/colinhacks/zod/commit/75d63ee1 "><code>75d63ee1</code></a>
docs: show only the <code>.properties()</code> method form in the 4.6
post</li>
<li><a
href="https://github.com/colinhacks/zod/commit/46da9572 "><code>46da9572</code></a>
docs: match the error-message examples to what the parsers emit</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042 "><code>b500a2e</code></a>
4.6.7</li>
<li><a
href="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 "><code>9c21983</code></a>
ci: stage at verbose so a failed OIDC token exchange says why</li>
<li><a
href="https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7 "><code>529f78d</code></a>
4.6.6</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd "><code>a0ebf97</code></a>
fix(v4): check array, set and map size bounds before parsing elements
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67 "><code>a2ba4a6</code></a>
fix(types): declare record output and input as members, not base type
argumen...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10 "><code>c42596b</code></a>
release: hold the run on the release-approval environment until the
staged ve...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290 "><code>bacad51</code></a>
docs: square the Code for Japan logo to match the other bronze
tiles</li>
<li><a
href="https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462 "><code>8fb2faf</code></a>
docs: crop the Code for Japan logo and list it first in bronze</li>
<li><a
href="https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa "><code>b2ef983</code></a>
docs: add Code for Japan to bronze sponsors</li>
<li><a
href="https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df "><code>74304ce</code></a>
release: stage npm versions instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.6.7 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-29 02:29:45 +09:00
Richard Scarrott
5a3e5dd739
fix(sdk-py): retry failed stream reconnects with backoff ( #9462 )
...
## Summary
A stream reconnect that fails to open (429, 5xx, transport error,
non-SSE response) is now retried with backoff instead of ending the
stream, e.g. while the server restarts or deploys.
```diff
HttpClient.stream / SyncHttpClient.stream, on reconnect (GET to Location)
- retry only a mid-read drop, with no delay, 5 times per stream
+ also retry a reconnect that fails to open: 429, 5xx, transport error, non-SSE
+ sleep 1, 2, 4, 5, 5s (+ up to 25% jitter) before each reconnect
+ reset the 5 attempts once a reconnect yields an event
+ give up with "Exceeded maximum…" raised from the last error
```
The first POST still raises on any error, since retrying it could start
a duplicate run. The backoff formula moves to `_shared/utilities.py`,
shared with the stream controllers.
The sleep also delays the first reconnect after a plain drop by about a
second, which matches the JS SDK. A run created without
`stream_resumable=True` can't replay what it sent while the client was
away, so it now loses about a second more of events. Resumable runs lose
nothing.
## Evidence
- **Before:** a reconnect hitting 429/502/503, a connect error or a
non-SSE response raised, a stream with 6 spaced-out drops gave up, and
reconnects never slept.
**After:** `test_client_stream.py` covers each (sync and async), plus
404 and first-POST failures staying fatal, and giving up after ~20s.
## Merge Danger
**Door:** two-way
**Blast Radius:** small (sdk-py stream reconnects only)
2026-10-28 11:46:39 +00:00
Hunter Lovell
eb8ec111b3
fix(langgraph): emit node-output messages from a graph streamed inside a node ( #9463 )
...
When a node streams a graph with `stream_mode="messages"`, messages that
one of that graph's nodes *returns* (rather than streams from an LLM)
are dropped. The same graph streamed at the top level reports them:
```python
def respond(state: MessagesState) -dict:
return {"messages": [AIMessage("hi there")]}
subgraph = StateGraph(MessagesState).add_node("respond", respond).add_edge(START, "respond").compile()
subgraph.stream(msgs, stream_mode="messages") # -> "hi there"
def parent_node(state, config):
for msg, _ in subgraph.stream(msgs, config, stream_mode="messages"):
... # -> nothing
```
A graph streamed this way attaches its own messages handler with the
node's namespace as `parent_ns`, so it still reports that graph's own
messages with `subgraphs=False` (#5836 ). `on_chat_model_start` honors
`parent_ns`, but `on_chain_start` didn't, so node outputs were filtered
out as if they came from a subgraph. This applies the same check in
`on_chain_start`.
Split out of #9453 (see @eliornl's [review
comment](https://github.com/langchain-ai/langgraph/pull/9453#discussion_r …)).
2026-10-27 14:46:39 -07:00
Hunter Lovell
8c177f7388
fix(langgraph): respect subgraphs=False in RemoteGraph.stream under a streaming parent ( #9453 )
...
When a node streams a `RemoteGraph` with `subgraphs=False` while its
parent graph is itself streamed with `subgraphs=True`,
`RemoteGraph.stream`/`astream` yield the remote graph's subgraph events
to the caller. With `stream_mode="updates"`, the node gets `['model',
'child']` where an in-memory graph streamed the same way gives
`['child']`.
`RemoteGraph` requests `stream_subgraphs=True` whenever the config
carries a parent stream, so the parent sees the remote graph's subgraph
events. Those events are forwarded to the parent correctly, but the
values yielded to the caller were never filtered by the caller's own
`subgraphs` setting. Locally this falls out of how streams are wired:
with `subgraphs=False` the run never installs the caller's queue for its
subgraphs, so their events only reach the parent. This applies the same
split on the client: subgraph events still go to the parent, and only
reach the caller when it passed `subgraphs=True`.
`messages` events are left as they are. The server's messages handler
dedupes across namespaces, so once it has sent a message from inside a
subgraph it doesn't send the top-level copy a `subgraphs=False` caller
would see locally. Filtering would leave that caller with nothing, so it
keeps getting the subgraph tokens, as today. Matching local exactly
needs the server to produce the caller's view; I'll open an issue for
that.
The new tests fail on `main`.
2026-10-27 14:40:42 -07:00
55013146ae
fix(sdk-py): match Auth.on overload to optional resources ( #9450 )
...
Match the `Auth.on` decorator-factory overload to its existing optional
`resources` argument so `auth.on()`, action-only calls, and
`resources=None` type-check. Add regression coverage for the overload
and wildcard registration; runtime authorization behavior is unchanged.
## References
- [Slack
thread](https://langchain.slack.com/archives/C0C411URFR6/p1792789013113819 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/094c284b-638a-5b04-95f0-623b47d0a52f )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Hunter Lovell <hntrl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-27 14:34:20 -07:00
Elior Nataf Lackritz
858891aaa1
fix(langgraph): don't report a paused tool as failed on the tools stream ( #9406 )
...
`interrupt()` inside a tool raises `GraphInterrupt`, and langchain-core
calls `on_tool_error` for every exception, so the `tools` stream
reported a tool that was only waiting for an answer as `tool-error`,
with the interrupt flattened into the message. With a subagent running
inside a tool, the outer tool showed as failed while the subagent waited
for approval. Fixes #8218 .
## Fix
- An interrupt or a drain ends the tool's events without a `tool-error`.
On resume the tool runs again and emits `tool-started` and
`tool-finished`. A parent command doesn't rerun the tool, so it still
ends the call with `tool-error`, as before.
- `astream` no longer runs every node in streaming mode just because the
`tools` handler is attached. Like the `messages` handler, it doesn't
need it, and with it a `@task` awaited inside a subgraph node returned
`None` whenever the `tools` mode was on.
The new tests fail on `main`.
## Release note
The `tools` stream no longer sends `tool-error` for a tool that pauses
on `interrupt()`. Until the run resumes, that tool has a `tool-started`
event and no end event. In-process `stream_events(version="v3")` now
ends that tool's stream as completed with no output, instead of failed
with the interrupt.
Same idea as #8219 by @haseeb-m4235 and #8282 by @thsfranca.
2026-10-26 19:35:13 -04:00
Elior Nataf Lackritz
1526b0e82d
fix(sdk-py): reset the reconnect cursor on every empty id ( #9440 )
...
#9402 made an empty `id:` field reset the reconnect cursor, so the next
reconnect sends no `Last-Event-ID`. Two cases still reconnected with the
old cursor.
- A `Last-Event-ID` header the caller passed in, as
`runs.join_stream(last_event_id=...)` does, stayed in the reconnect
headers. A stream joined at 5 that sent id 6 and then an empty id
reconnected from 5, so event 6 arrived twice. Once the stream has sent
an `id:` field, the caller's header is now dropped, in any letter case,
and the stream's cursor is sent if it is not empty. This also stops a
caller header spelled `last-event-id` from going out next to the SDK's
own `Last-Event-ID`.
- An empty `id:` on its own, with no event or data in its block, never
reached the stream loop, because the decoder skipped the block as empty.
The decoder now returns it as an empty part. The stream loop takes the
reset from it and, like every other caller in the SDK, drops the part.
The new test cases fail on `main`.
Both cases were reported by @1052326311 on #9014 and by @Tivonsico on
#9230 , whose suggested approach this follows. Related: #9299 , not fixed
here.
## Release note
Once a stream has sent an `id:` field, reconnects no longer send a
`Last-Event-ID` header the caller passed in. After an empty `id:`,
`SSEDecoder.decode` returns an empty part, with no event and no data,
for each block that has neither, as it already did after a non-empty id.
2026-10-26 20:31:20 +00:00
Elior Nataf Lackritz
c2c73b4f91
fix(langgraph): return an awaited @task's value while streaming ( #9407 )
...
A `@task` awaited inside a node returned `None` whenever the node ran in
streaming mode, which `astream_events` (v1 and v2) turns on, and so does
everything built on it. With streaming, `arun_with_retry` drains the
task's `astream()` and returned nothing, so the awaiting node got
`None`. Fixes #9284 .
It now returns the value the task wrote, on both stream paths (with and
without a timeout).
The new test fails on `main` for v1 and v2, including a task that
returns a falsy value.
Same idea as #9295 by @AaronG18, and the lookup @amishaguptaberk
suggested on the issue.
2026-10-26 20:29:22 +00:00
Sera
03e73ff51b
feat(langgraph): list ToolNode tool names in graph node metadata ( #9449 )
...
A `ToolNode` appears in `get_graph()` output as a plain runnable named
`tools`. Graph viewers such as Studio can't show which tools it runs,
and with deep agents that's most of what the agent does.
## Changes
- `draw_graph` adds `metadata["__tools"]`, the node's tool names in
order, for any node with a non-empty `tools_by_name`.
- The check is duck-typed, so core doesn't import from
`langgraph-prebuilt`.
## Reviewer notes
- Names only. Tool descriptions are long for deep agents and would bloat
`/graph` payloads.
- This sits next to `__interrupt`. Like it, `__tools` shows up in node
labels from `draw_mermaid(with_styles=True)`, but not in the
`with_styles=False` output.
## Test Plan
- [x] The `to_json()` snapshots for `create_react_agent` and the
hand-built `ToolNode` graph now include `__tools`.
- [x] A local deep agent's `/assistants/{id}/graph` response lists all
11 tools on the `tools` node.
2026-10-26 16:11:08 -04:00
Elior Nataf Lackritz
3521f08e21
release(checkpoint): 4.3.1 ( #9447 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpoint==4.3.0`:
- #9383 - reject NUL bytes in store namespace labels
2026-10-26 19:47:44 +00:00
Elior Nataf Lackritz
24294fad37
release(langgraph): 1.2.18 ( #9445 )
...
Bumps langgraph from 1.2.17 to 1.2.18.
Includes:
- Default `DeltaChannel` snapshots to every 100 updates instead of 1000
(#9420 )
- Let `error_handler` recover on every path and stream failed task
results (#9408 )
- Stream the last checkpoint of a run stopped by `interrupt_after` or
the recursion limit (#9409 )
- Stop duplicating tags at every subgraph level (#9400 )
2026-10-26 15:40:09 -04:00
Elior Nataf Lackritz
f6317d5cb1
release(sdk-py): 0.4.10 ( #9446 )
...
Bumps the Python SDK version from 0.4.9 to 0.4.10.
Includes:
- Retry `runs.wait` with a bodyless GET and raise run errors in the sync
`wait` (#9399 )
- Follow the SSE spec for multi-line data, empty ids and a leading BOM
(#9402 )
- Accept `durability`, `stream_resumable` and `context` in the `runs`
overloads (#9403 )
2026-10-26 15:40:04 -04:00
Elior Nataf Lackritz
7e56e6c80b
fix(langgraph): let error_handler recover on every path and stream failed task results ( #9408 )
...
- A node's `error_handler` ran, but the original error was still raised
when the node ran on the executor path: when streaming `messages` or
`custom`, with `subgraphs=True`, or next to a parallel node. The runner
marked the handled task's future, but the executors re-raised every
failed future on exit without checking the mark. The mark now lives in
the executor module, and both executors skip those futures. Fixes #8608 .
- With only `tasks` or `debug` streaming, a failing task's result (with
its `error`) was never streamed: the single-task fast path raised before
the caller drained the stream queue. It now yields once before
re-raising. Fixes #5764 .
The new tests fail on `main`.
Ideas from #8278 by @UdayKiranJadi, #8611 by @SnowingFox, #8823 by
@sailikhithk, #6984 by @Br1an67 and #8400 by @cms19859230182-lang.
2026-10-26 14:15:25 -04:00
0fc4f35b66
feat(langgraph)!: default delta snapshots to 100 updates ( #9420 )
...
Change `DeltaChannel`'s default `snapshot_frequency` from 1000 to 100
updates, including channels used for messages, to bound replay latency
with more frequent snapshots. Explicit overrides remain unchanged.
Co-authored-by: Elior Nataf Lackritz <eliornl@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-26 13:28:01 -04:00
raghavverma-langchain
58be6911de
release(cli): 0.4.40 ( #9443 )
...
## Summary
bumps the cli to 0.4.40 to cut a release with #9396 , the only cli change
since 0.4.39
- `langgraph deploy --remote` now sends whatever headers the control
plane returns with the source upload url, so uploads work with storage
that needs extra headers (like azure blob storage)
- control planes that dont return any headers keep the old behavior, so
nothing changes for existing setups
## Test Plan
- [x] #9396 (send the upload headers the control plane returns) is the
only CLI change merged since 0.4.39
- [ ] After merge, run the `release` workflow with `working-directory:
libs/cli` (merging doesn't publish by itself)
- [ ] `pip install -U langgraph-cli` picks up 0.4.40
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-26 16:25:10 +00:00
raghavverma-langchain
1adeafeaf3
feat(cli): send the upload headers the control plane returns ( #9396 )
...
## Summary
some storage needs extra headers on the signed upload PUT (azure blob
storage 400s without `x-ms-blob-type`), and `langgraph deploy --remote`
always sent the same gcs style headers no matter what. this lets the
control plane tell the cli what to send
- `request_upload_url` now sends `supports_upload_headers: true` so the
control plane knows this cli can handle it
- if the response has `upload_headers` the upload sends exactly those +
content-length. if not its the same defaults as before so older control
planes wont see a difference
- content-type stays as a fallback, otherwise urllib sneaks in a form
content type and that breaks signed urls
## Test Plan
- [x] `make lint` and `make test` pass in `libs/cli` (576 tests)
- [x] New tests: the upload-url request carries the flag; returned
headers are sent as-is plus the real `Content-Length` (overriding a
returned one); missing or empty `upload_headers` sends the old defaults;
returned headers without a `Content-Type` still send `application/gzip`.
Each fails without the change
- [x] Against a real Azure Blob Storage upload URL: 0.4.36 fails with
`MissingRequiredHeader` (`x-ms-blob-type`), and this branch's upload
with the returned headers succeeds (201)
- [ ] After release, `langgraph deploy --remote` still uploads against a
control plane that returns no `upload_headers`
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-26 11:02:08 -04:00
Hugo DURAND
dc1741ce96
release(cli): 0.4.39 ( #9442 )
...
Bumps the CLI to 0.4.39 to cut a release including #9395 , the only CLI
change merged since 0.4.38:
- `langgraph deploy list --json` prints `[{"id": "...", "name":
"..."}]`, so a CI job can check whether a deployment exists before it
deploys.
- `deploy list` and `deploy listeners list` now read every page, instead
of stopping at 20 deployments or 100 listeners.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-26 10:14:16 -04:00
Igor Soarez
244ca657e4
docs: add "Direction: LangGraph is a runtime" section to AGENTS.md ( #9439 )
...
## What
Adds a "Direction" section to `AGENTS.md`, placed before the library
list so it frames how the rest of the file is read. It states the
project's strategic direction for contributors — human and coding-agent
alike:
- LangGraph is consolidating as the low-level **runtime** for agents and
workflows (graph execution, checkpointing, streaming, interrupt/resume),
and is moving away from being a friendly SDK for building agents
directly.
- Agent development belongs on a harness; Deep Agents (separate repo) is
the recommended one.
- Contributions are optimized for runtime correctness, reliability,
performance, and simplicity — not for the shortest agent example.
## Why
LangGraph today is both a runtime and an agent-building SDK. As agent
harnesses have consolidated, keeping both roles blurs the contribution
criteria: "should I add this convenience helper?" and "is this the right
place for this feature?" have no written answer. `AGENTS.md` is the
first thing a coding agent reads before touching this repo; giving it an
explicit direction makes that judgment mechanical and aligns
agent-generated contributions with where the project is going.
## Notes for reviewers
- **The ratchet is stated inline, not linked.** The section embeds the
stabilization rule ("one way to do each thing, and every change leaves
fewer ways than it found") directly, because that rule currently has no
home in this repo. If the full stabilization policy lands in
`CONTRIBUTING.md`, the bullet can shrink to a link and the "deprecation
process" reference can point at it.
- **Scope is explicit.** The consolidation mandate applies to the
runtime core (`langgraph`, `checkpoint*`); the client SDKs and CLI
remain ergonomic, as thin clients.
- **`prebuilt` is marked maintenance-only**, matching its state in code
(`create_react_agent` is already `@deprecated` in favour of
`langchain.agents`). The library list itself is unchanged in this PR;
rewording the `langgraph` and `prebuilt` descriptions could be a
follow-up.
- **Removal discipline is part of the section**: breaking changes must
be a PR's stated purpose and go through deprecation — never a side
effect of an unrelated change. The intent is to prevent agents from
over-reading the direction as license for opportunistic removals.
- **Companion PR:** a matching section adapted for
langchain-ai/langgraphjs follows.
Nothing here changes code or CI; this is a documentation-only change to
contributor guidance.
2026-10-26 15:56:56 +02:00
Hugo DURAND
c696d4e79f
feat(cli): add --json to deploy list ( #9395 )
...
This PR adds a `--json` flag to the `langgraph deploy list` CLI command.
It solves the issue of CI/CD pipelines having to parse complex ASCII
tables by providing a structured JSON output (e.g., `[{"id": "...",
"name": "..."}]`) to check for existing deployments. It also fixes a
limitation where the CLI previously only fetched the first 20
deployments by implementing proper pagination.
## Changes
* **Added `--json` flag:** Outputs a clean, allow-listed JSON array of
deployments.
* **Stripped secrets:** Explicitly excludes environment variables from
the JSON output to prevent leaking secrets in CI logs.
* **Full pagination:** Updates the backend to fetch all limit/offset
pages, ensuring all deployments (not just the first 20) are retrieved.
* **Cleaned standard output:** Moved beta warnings to `stderr` and
disabled interactive prompts when using `--json` to guarantee valid JSON
on `stdout`.
* **Centralized formatting:** Refactored three separate table rendering
functions into a single shared `Table` and `JsonOutput` logic.
## Test
* **Automated checks:** Passed `make format`, `make lint`, and `make
test` (580 tests total).
* **New unit tests:** Added extensive testing for JSON shape, secret
omission, empty lists, missing IDs, stderr routing, and multi-page
retrieval logic.
* **Manual verification:** Tested against a local mock control plane
with 101 deployments, verifying that `jq` can successfully parse the
output and check for specific deployment names.
Release Note: Added `--json` flag to `langgraph deploy list` to support
scriptable, structured deployment lookups in CI/CD environments.
2026-10-26 09:45:57 -04:00
Elior Nataf Lackritz
34c7f58655
fix(sdk-py): retry runs.wait with a bodyless GET and raise run errors in sync wait ( #9399 )
...
Two `runs.wait` bugs in the Python SDK.
- When the response of `runs.wait` broke off mid-read, the SDK retried
with a GET to the `Location` header, but that GET reused the POST's
`Content-Length` and `Content-Type`, so the only retry always failed
with `h11.LocalProtocolError`. The sync client also sent a JSON `null`
body on every body-less request made this way (`runs.join`,
`runs.cancel(wait=True)`). Fixes #7858 .
- Sync `runs.wait(raise_error=True)` returned a failed run's
`{"__error__": ...}` as a normal result, and sent `raise_error` to the
server, which ignores it. The async client raises. Fixes #8383 .
## Fix
The retry GET carries only the caller's headers, and the sync client
sends no body for `json=None`, as the async one already did. Sync
`runs.wait` checks `__error__` like the async client and no longer sends
`raise_error`.
The new tests fail on `main`.
## Release note
Sync `runs.wait` now raises when the run fails, as `raise_error=True`
(the default) always documented. Code that reads `__error__` from the
result should pass `raise_error=False`.
Ideas from #7869 by @pragnyanramtha, #8385 by @Solaris-star and #9377 by
@ShallAbby.
2026-10-26 09:25:00 -04:00
Elior Nataf Lackritz
1b1aee689d
fix(langgraph): stream the last checkpoint of a run stopped by interrupt_after or the recursion limit ( #9409 )
...
When a run stopped at an `interrupt_after` pause or at the recursion
limit, the checkpoint it stopped on was never sent on the `checkpoints`
or `debug` stream. A checkpoint is streamed at the start of the next
tick, which works out its next tasks; `interrupt_after` raises right
after saving it, and the recursion limit stops the run at the start of
the next tick before that point. A client that resumes from the last
checkpoint it saw ran the last node again. Fixes #9180 .
The block that prepares the next tasks and streams the checkpoint moves
into one method, called by `tick` and on both of those exits.
The new tests fail on `main` with every checkpointer in the suite.
## Release note
The `checkpoints` and `debug` streams send one more event when a run
stops at an `interrupt_after` pause or at the recursion limit: the
checkpoint it stopped on.
Same approach as @jayhemnani9910's branch on the issue.
2026-10-26 09:18:02 -04:00
Elior Nataf Lackritz
27aeb75efd
fix(langgraph): stop duplicating tags at every subgraph level ( #9400 )
...
Tags passed at invoke time are repeated at every subgraph level: a node
one subgraph deep sees each tag twice, three levels deep 8 times. The
copies show up in the node's `config["tags"]`, in `messages` stream
metadata and in traces. Fixes #9084 .
## Cause
`ensure_config` appends the tags of explicit configs to the ambient
config's tags, so tags bound with `with_config` survive. A subgraph is
called with its parent's config, which the ambient config also holds, so
the parent's tags are appended a second time at each level.
## Fix
`ensure_config` skips tags the ambient config already has. Tags repeated
across explicit configs are still concatenated, as before.
The new tests fail on `main`.
Same approach as #9110 by @mudscode.
2026-10-26 08:56:49 -04:00
Elior Nataf Lackritz
c18a42fcba
fix(sdk-py): follow the SSE spec for multi-line data, empty ids and a leading BOM ( #9402 )
...
The Python SDK's SSE decoder broke three rules of the SSE spec.
- Repeated `data:` lines were concatenated without a newline, so a value
split across lines could decode to a different one: `[1` then `0]`
became `[10]`. They are now joined with a newline. Fixes #7915 .
- An empty `id:` field did not reset the reconnect cursor, so a
reconnect after it resumed from the previous id. It now clears the
cursor, and the reconnect sends no `Last-Event-ID`. Fixes #9009 .
- A UTF-8 BOM at the start of a stream became part of the first field
name, so the first event lost its type. It is now stripped. Fixes #9225 .
A server that writes each event's data on one line, with no BOM and no
empty ids, sees no change.
The new tests fail on `main`.
## Release note
Multi-line `data:` fields are joined with newlines, so data that only
parsed because its lines were glued together now raises a decode error.
`SSEDecoder.last_event_id` returns `""` after an empty `id:` field,
instead of `None`.
Ideas from #7936 by @NishchayMahor, #7947 by @tayyub-ai, #9014 by
@daleselaji-dev and #9236 by @Kayvan-Zahiri.
2026-10-26 08:56:37 -04:00
Elior Nataf Lackritz
b54566b620
fix(sdk-py): accept durability, stream_resumable and context in the runs overloads ( #9403 )
...
The `@overload` stubs of `runs.stream`, `runs.create` and `runs.wait`
left out parameters their implementations accept, so type checkers
rejected valid calls, for example `client.runs.wait(thread_id,
assistant_id, durability="sync")` (mypy: "Unexpected keyword argument").
Fixes #8442 .
Added `durability` to all 16 stubs, `stream_resumable` to the two sync
stateful `stream` stubs, and `context` to the two async stateless
`stream` stubs. A new test parses both runs clients and checks that
every overload accepts the implementation's keyword parameters, except
the ones a run kind leaves out on purpose (thread-only parameters on
stateless runs, `on_completion` on stateful ones). It fails on `main`,
and mypy accepts the calls above with this change.
Covers the gap #7101 by @KartikPawade fixed for `stream_resumable`.
Co-authored-by: Kartik Pawade
<81703361+KartikPawade@users.noreply.github.com >
Co-authored-by: Anurag Paul
<231525521+anuragpaul602-netizen@users.noreply.github.com >
2026-10-26 08:56:26 -04:00
dependabot[bot]
a25bfafe48
chore(deps): bump zod from 4.3.6 to 4.6.7 in /libs/cli/js-examples ( #9432 )
...
Bumps [zod](https://github.com/colinhacks/zod ) from 4.3.6 to 4.6.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/colinhacks/zod/releases ">zod's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.7</h2>
<h2>Commits:</h2>
<ul>
<li>b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7</li>
</ul>
<h2>v4.6.6</h2>
<blockquote>
<p>Six malicious commits pushed to <code>main</code> on September 21
with a compromised git credential were reverted the same day in <a
href="https://redirect.github.com/colinhacks/zod/issues/6620 ">#6620</a>
and have since been removed from the history of <code>main</code>. None
were ever published to npm. The npm provenance for 4.6.6 names 284243fb,
the pre-rewrite copy of 9c219833 with identical contents.</p>
</blockquote>
<h2>Commits:</h2>
<ul>
<li>0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale
directly in Zod Mini</li>
<li>9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from
zod/locales, not z.locales</li>
<li>34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales
tree-shaking note</li>
<li>74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions
instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to
bronze sponsors</li>
<li>8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for
Japan logo and list it first in bronze</li>
<li>bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for
Japan logo to match the other bronze tiles</li>
<li>c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on
the release-approval environment until the staged versions are approved
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6638 ">#6638</a>)</li>
<li>a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record
output and input as members, not base type arguments (<a
href="https://redirect.github.com/colinhacks/zod/issues/6645 ">#6645</a>)</li>
<li>a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set
and map size bounds before parsing elements (<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li>529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6</li>
<li>9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a
failed OIDC token exchange says why</li>
</ul>
<h2>v4.6.5</h2>
<h2>Commits:</h2>
<ul>
<li>d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch
highlights to the 4.6 post</li>
<li>f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch
highlights into the 4.6 post's own sections</li>
<li>de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties
section with the check and add a Zod Mini tab (<a
href="https://redirect.github.com/colinhacks/zod/issues/6598 ">#6598</a>)</li>
<li>56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the
.properties() shape off the instance type (<a
href="https://redirect.github.com/colinhacks/zod/issues/6600 ">#6600</a>)</li>
<li>ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add
z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)"</li>
<li>cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert
"feat: add z.currencyCode() over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/issues/6595 ">#6595</a>)""</li>
<li>0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5</li>
<li>59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the
integration peers to the workspace zod after the 4.6.5 bump</li>
</ul>
<h2>v4.6.4</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.3 ">4.6.3</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/d6bc1e30 "><code>d6bc1e30</code></a>
feat: add <code>z.currencyCode()</code> over a vendored ISO 4217 list,
refreshed weekly by CI (<a
href="https://redirect.github.com/colinhacks/zod/pull/6595 ">#6595</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/ad32d751 "><code>ad32d751</code></a>
perf: <code>z.url()</code> rejects an invalid URL with
<code>URL.canParse()</code> instead of a throwing constructor, about 50x
faster; fewer allocations on the validation path (<a
href="https://redirect.github.com/colinhacks/zod/pull/6588 ">#6588</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/2bb08717 "><code>2bb08717</code></a>
chore: re-pin the integration peers to the workspace zod after the 4.6.4
bump</li>
<li><a
href="https://github.com/colinhacks/zod/commit/f6e1701a "><code>f6e1701a</code></a>
chore(deps): bump next to 15.5.25 and vite to 7.3.6 (<a
href="https://redirect.github.com/colinhacks/zod/pull/6153 ">#6153</a>)</li>
</ul>
<h2>v4.6.3</h2>
<p>A patch on top of <a
href="https://github.com/colinhacks/zod/releases/tag/v4.6.2 ">4.6.2</a>.</p>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/413cce9a "><code>413cce9a</code></a>
fix(v4): make z.properties() a check again (<a
href="https://redirect.github.com/colinhacks/zod/pull/6594 ">#6594</a>) —
removes the standalone <code>z.properties()</code> schema from 4.6.0;
<code>z.instanceof().properties()</code> and
<code>.check(...z.properties())</code> are unchanged</li>
<li><a
href="https://github.com/colinhacks/zod/commit/75d63ee1 "><code>75d63ee1</code></a>
docs: show only the <code>.properties()</code> method form in the 4.6
post</li>
<li><a
href="https://github.com/colinhacks/zod/commit/46da9572 "><code>46da9572</code></a>
docs: match the error-message examples to what the parsers emit</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042 "><code>b500a2e</code></a>
4.6.7</li>
<li><a
href="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 "><code>9c21983</code></a>
ci: stage at verbose so a failed OIDC token exchange says why</li>
<li><a
href="https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7 "><code>529f78d</code></a>
4.6.6</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd "><code>a0ebf97</code></a>
fix(v4): check array, set and map size bounds before parsing elements
(<a
href="https://redirect.github.com/colinhacks/zod/issues/6652 ">#6652</a>)</li>
<li><a
href="https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67 "><code>a2ba4a6</code></a>
fix(types): declare record output and input as members, not base type
argumen...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10 "><code>c42596b</code></a>
release: hold the run on the release-approval environment until the
staged ve...</li>
<li><a
href="https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290 "><code>bacad51</code></a>
docs: square the Code for Japan logo to match the other bronze
tiles</li>
<li><a
href="https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462 "><code>8fb2faf</code></a>
docs: crop the Code for Japan logo and list it first in bronze</li>
<li><a
href="https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa "><code>b2ef983</code></a>
docs: add Code for Japan to bronze sponsors</li>
<li><a
href="https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df "><code>74304ce</code></a>
release: stage npm versions instead of publishing them (<a
href="https://redirect.github.com/colinhacks/zod/issues/6622 ">#6622</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/colinhacks/zod/compare/v4.3.6...v4.6.7 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for zod since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 15:27:13 +00:00
dependabot[bot]
471fee3dff
chore(deps): bump langgraph-checkpoint-postgres from 3.1.1 to 3.1.3 in /libs/cli/uv-examples/monorepo in the uv group across 1 directory ( #9422 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory:
[langgraph-checkpoint-postgres](https://github.com/langchain-ai/langgraph ).
Updates `langgraph-checkpoint-postgres` from 3.1.1 to 3.1.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-checkpoint-postgres's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-checkpoint-postgres==3.1.3</h2>
<p>Changes since checkpointpostgres==3.1.2</p>
<ul>
<li>release(checkpoint-postgres): 3.1.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9287 ">#9287</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): treat an empty
checkpoint_id as the latest in delta history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9262 ">#9262</a>)</li>
<li>perf(checkpoint-postgres): start the delta walk at the target (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9248 ">#9248</a>)</li>
<li>fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate
namespace labels before store dispatch (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9217 ">#9217</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 6 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9147 ">#9147</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9132 ">#9132</a>)</li>
<li>fix(checkpoint-postgres): derive the delta walk cursor once the
target loads (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8556 ">#8556</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 3 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8773 ">#8773</a>)</li>
<li>fix(checkpoint): widen <code>Store</code> <code>put</code> value
type to <code>Mapping[str, Any]</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8617 ">#8617</a>)</li>
</ul>
<h2>langgraph-checkpoint-postgres==3.1.2</h2>
<p>Changes since checkpointpostgres==3.1.1</p>
<ul>
<li>release(checkpoint-postgres): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8565 ">#8565</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
<li>test(checkpoint-postgres,checkpoint-sqlite): run the conformance
suite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8537 ">#8537</a>)</li>
<li>fix(checkpoint-postgres): find plain-value seeds when walking delta
history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8535 ">#8535</a>)</li>
<li>chore: enable RUF100 and clear unused noqa directives (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8546 ">#8546</a>)</li>
<li>chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint
rule (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8540 ">#8540</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8497 ">#8497</a>)</li>
</ul>
<h2>langgraph-checkpoint-sqlite==3.1.2</h2>
<p>Changes since checkpointsqlite==3.1.1</p>
<ul>
<li>release(checkpoint-sqlite): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9288 ">#9288</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): treat an empty
checkpoint_id as the latest in delta history (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9262 ">#9262</a>)</li>
<li>fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate
namespace labels before store dispatch (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9217 ">#9217</a>)</li>
<li>fix: order delta channel replay by task path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8544 ">#8544</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 3 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9146 ">#9146</a>)</li>
<li>chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9135 ">#9135</a>)</li>
<li>fix(checkpoint-sqlite): walk delta ancestors by parent pointer (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8557 ">#8557</a>)</li>
<li>chore(deps): bump anyio from 4.12.1 to 4.14.2 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8993 ">#8993</a>)</li>
<li>chore(deps-dev): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 2 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8772 ">#8772</a>)</li>
<li>fix(checkpoint): widen <code>Store</code> <code>put</code> value
type to <code>Mapping[str, Any]</code> (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8617 ">#8617</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
<li>test(checkpoint-postgres,checkpoint-sqlite): run the conformance
suite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8537 ">#8537</a>)</li>
<li>chore: enable RUF100 and clear unused noqa directives (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8546 ">#8546</a>)</li>
<li>chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint
rule (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8540 ">#8540</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 4 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8494 ">#8494</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/afbe7e48b17f62e139b5c6337ab934549e6dc73b "><code>afbe7e4</code></a>
release(checkpoint-postgres): 3.1.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9287 ">#9287</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1074714c260486900d9bec9b5dd48e13883dd5df "><code>1074714</code></a>
release(checkpoint-sqlite): 3.1.2 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9288 ">#9288</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/740461ed50f89f867b0c3a1e46fa6d2a4e339cf4 "><code>740461e</code></a>
release(sdk-py): 0.4.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9289 ">#9289</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/08a345637fb2bd499f69c90056a22c478a468817 "><code>08a3456</code></a>
release(langgraph): 1.2.15 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9283 ">#9283</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b7d053b256157ac6b8e8ff5a0783f8a446a9c89e "><code>b7d053b</code></a>
fix(langgraph): give every message written to a messages DeltaChannel an
id (...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/395c145c047aaf962a4f599582bbc8d717bd9fa1 "><code>395c145</code></a>
fix(langgraph): save a cached node's writes like a node that ran (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/9259 ">#9259</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/10f1fabb3b2f2d550b8133fba1217391c27694c4 "><code>10f1fab</code></a>
fix(langgraph): stop at an interrupt_before breakpoint when a drain is
reques...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/799c2f04fd3a56186e24e9fb8bbf3568e543cfbe "><code>799c2f0</code></a>
fix(langgraph): keep an exit run from a checkpoint the thread moved past
out ...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b4991f1ba36a2449ab59c38ab71828ee865bff84 "><code>b4991f1</code></a>
fix(langgraph): store an update_state input's writes on the checkpoint
it upd...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/6aa0afba682b0308fbcace31f66fb532978d4dca "><code>6aa0afb</code></a>
fix(checkpoint): default InMemorySaver delta history to the latest
checkpoint...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/checkpointsqlite==3.1.1...checkpointpostgres==3.1.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-26 00:09:10 +09:00
dependabot[bot]
7bf29e9798
chore(deps): bump virtualenv from 21.7.13 to 21.14.13 in /libs/cli ( #9427 )
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 21.7.13 to
21.14.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases ">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.14.13</h2>
<h1>Bugfixes - 21.14.13</h1>
<ul>
<li>
<p>Stop bash running commands from <code>--prompt</code> or an
environment name containing <code>$(...)</code>, backticks or a
backslash
after <code>shopt -s promptvars</code>, <code>set -o posix</code>, or in
a child shell that inherits an exported <code>PS1</code>
(GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt
from <code>psvar[9]</code>, which is never parsed
as shell syntax.</p>
<p>Write the <code>.venv</code> redirect and the wheel
<code>RECORD</code> with exclusive create, so a link planted after the
existence
check cannot redirect the write. On POSIX, a read-only
<code>.venv</code> redirect that points at a virtualenv is replaced.
(<a
href="https://redirect.github.com/pypa/virtualenv/issues/3466 ">#3466</a>)</p>
</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.13/ ">PyPI
release</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13 ">https://github.com/pypa/virtualenv/compare/21.14.12...21.14.13 </a></p>
<h2>21.14.12</h2>
<h1>Bugfixes - 21.14.12</h1>
<ul>
<li>
<p>Upgrade embedded wheels:</p>
<ul>
<li>setuptools to <code>84.2.1</code> from <code>84.0.0</code></li>
<li>pip to <code>26.2.2</code> from <code>26.2.1</code> (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3452 ">#3452</a>)</li>
</ul>
</li>
</ul>
<h1>Improved Documentation - 21.14.12</h1>
<ul>
<li>Require a pull request news fragment and a matching changelog
section before publishing. (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3445 ">#3445</a>)</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.12/ ">PyPI
release</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.14.11...21.14.12 ">https://github.com/pypa/virtualenv/compare/21.14.11...21.14.12 </a></p>
<h2>21.14.11</h2>
<h1>Bugfixes - 21.14.11</h1>
<ul>
<li>Search all directories supplied by repeated
<code>--extra-search-dir</code> options instead of keeping only the last
group.
(<a
href="https://redirect.github.com/pypa/virtualenv/issues/3440 ">#3440</a>)</li>
<li>On Windows, the app data is now migrated into the nested cache
directory instead of the migration failing with a
warning on every run. (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3441 ">#3441</a>)</li>
</ul>
<p><a href="https://pypi.org/project/virtualenv/21.14.11/ ">PyPI
release</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst ">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.14.13</h1>
<ul>
<li>
<p>Stop bash running commands from <code>--prompt</code> or an
environment name containing <code>$(...)</code>, backticks or a
backslash
after <code>shopt -s promptvars</code>, <code>set -o posix</code>, or in
a child shell that inherits an exported <code>PS1</code>
(GHSA-cx6f-vjhg-g3cc); reported by :user:<code>rozzkml</code>. zsh now
draws the prompt from <code>psvar[9]</code>, which is never parsed
as shell syntax.</p>
<p>Write the <code>.venv</code> redirect and the wheel
<code>RECORD</code> with exclusive create, so a link planted after the
existence
check cannot redirect the write. On POSIX, a read-only
<code>.venv</code> redirect that points at a virtualenv is replaced.
(:issue:<code>3466</code>)</p>
</li>
</ul>
<hr />
<p>v21.14.12 (2026-10-21)</p>
<hr />
<h1>Bugfixes - 21.14.12</h1>
<ul>
<li>
<p>Upgrade embedded wheels:</p>
<ul>
<li>setuptools to <code>84.2.1</code> from <code>84.0.0</code></li>
<li>pip to <code>26.2.2</code> from <code>26.2.1</code>
(:issue:<code>3452</code>)</li>
</ul>
</li>
</ul>
<h1>Improved Documentation - 21.14.12</h1>
<ul>
<li>Require a pull request news fragment and a matching changelog
section before publishing. (:issue:<code>3445</code>)</li>
</ul>
<hr />
<p>v21.14.11 (2026-10-18)</p>
<hr />
<h1>Bugfixes - 21.14.11</h1>
<ul>
<li>Search all directories supplied by repeated
<code>--extra-search-dir</code> options instead of keeping only the last
group.
(:issue:<code>3440</code>)</li>
<li>On Windows, the app data is now migrated into the nested cache
directory instead of the migration failing with a
warning on every run. (:issue:<code>3441</code>)</li>
</ul>
<hr />
<p>v21.14.10 (2026-10-17)</p>
<hr />
<h1>Bugfixes - 21.14.10</h1>
<ul>
<li>Always copy seed packages when app-data is temporary, including when
symlink seeding is enabled through an environment
variable or configuration file. Seeded packages remain available after
temporary cache cleanup. (:issue:<code>3437</code>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/6accbd5ee857f6d7a5a59b1bd3db25cd5f04174a "><code>6accbd5</code></a>
release 21.14.13</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 "><code>3598e20</code></a>
🐛 fix(bash): escape the prompt for every PS1 state (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3466 ">#3466</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/f6512a559dc5a4561b8364881aee0f8ea7341e9b "><code>f6512a5</code></a>
release 21.14.12</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/b5357267d81fcb95672fa2fe8f33108de4b04a33 "><code>b535726</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3455 ">#3455</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/7e32366ab551514994a7d455ffb203208ecdc08b "><code>7e32366</code></a>
Fix broken pip and code review links in the docs (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3460 ">#3460</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/632e56fc92d8f64da72922f3e9da569491bc52c7 "><code>632e56f</code></a>
Upgrade embedded pip/setuptools/wheel and CI test tools (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3452 ">#3452</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a8bd1a916a5629859307c153bfc1924e56ba969c "><code>a8bd1a9</code></a>
chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3462 ">#3462</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/c82323bb7140ed678b2485e00c3785525f4e91af "><code>c82323b</code></a>
chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3461 ">#3461</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/863ae6ccfe1878e77b6f00074f3fd91664c8c0aa "><code>863ae6c</code></a>
chore(deps): bump the runtime-dependencies group with 3 updates (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3456 ">#3456</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/79537b3461bf150d3eb439347f2858b8ecd504f8 "><code>79537b3</code></a>
👷 ci: pin App token action v3.3.0 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3449 ">#3449</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/virtualenv/compare/21.7.13...21.14.13 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 10:03:59 +00:00
dependabot[bot] and John Kennedy
80133010ac
chore(deps): bump opentelemetry-api from 1.39.1 to 1.45.1 in /libs/langgraph ( #9424 )
...
Bumps
[opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python )
from 1.39.1 to 1.45.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/releases ">opentelemetry-api's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1</h2>
<p>This is a patch release on the previous 1.45.0/0.66b0 release, fixing
the issue(s) below.</p>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for long running resource detectors (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default HTTP transport so proxy environment
variables such as <code>HTTPS_PROXY</code> are honored again (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header and discard <code>tracestate</code>
headers longer than 8192 characters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource attributes as metric labels (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute values everywhere. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative configuration — when set,
maps the OTel <code>SeverityNumber</code> value to a Python logging
level and applies it to the <code>opentelemetry</code> logger so SDK
internal diagnostics respect the configured severity. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add <code>log_record_limits</code> support to
<code>LoggerProvider</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the Logger API, SDK, and
<code>LogRecordProcessor</code> to let instrumentation skip expensive
work when logging is disabled (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental
<code>tracer_configurator/development</code>,
<code>meter_configurator/development</code> and
<code>logger_configurator/development</code> fields into
<code>create_tracer_provider</code>, <code>create_meter_provider</code>
and <code>create_logger_provider</code>, so per-instrumentation-scope
<code>enabled</code> overrides declared in the config file are applied
to the provider (previously these fields were parsed but silently
discarded). The logger
<code>minimum_severity</code>/<code>trace_based</code> fields are not
supported by the Python SDK and are ignored with a warning. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418 ">#5418</a>)</li>
<li><code>docs/examples</code>: add example on how to manually setup the
SDK to get SDK metrics (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449 ">#5449</a>)</li>
<li><code>opentelemetry-docker-tests</code>: add Prometheus exporter
docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457 ">#5457</a>)</li>
<li><code>opentelemetry-sdk</code>: count records dropped after shutdown
on <code>otel.sdk.processor.{span,log}.processed</code> with
<code>error.type=already_shutdown</code> (batch span/log and simple log
processors), which the semantic conventions define as a valid value for
this metric. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509 ">#5509</a>)</li>
<li><code>opentelemetry-semantic-conventions</code>: update semantic
conventions to v1.44.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511 ">#5511</a>)</li>
<li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host
resource detector (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653 ">#5653</a>)</li>
<li><code>opentelemetry-test-utils</code>: add
<code>CapturingSampler</code> to record what samplers receive in
instrumentation tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681 ">#5681</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all
violations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150 ">#5150</a>)</li>
<li>The public <code>opentelemetry.util.types.AttributeValue</code> type
in package <code>opentelemetry-api</code> is being expanded to include
<code>None</code>, heterogeneous sequences of primitive types (and
nested sequences) as opposed to only homogeneous primitive sequences,
and Mappings of strings to any primitive types or sequences/mappings
(which themselves must only contain primitive types or
sequences/mappings validated the same way). If a <code>bytes</code> type
is set as an attribute value in the SDK, it will no longer be utf-8
decoded to a string, instead it will be passed along as is in accordance
with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP
proto. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: add a
<code>max_request_size</code> argument to the OTLP HTTP exporters
(traces, logs, metrics); serialized requests larger than the limit are
dropped before sending, measured before compression. Defaults to 64 MiB
(enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369 ">#5369</a>)</li>
<li>[BREAKING] <code>opentelemetry-api</code>: subclasses of
<code>Logger</code> need to implement the <code>enabled</code> method
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use
shared opentelemetry-exporter-otlp-common and
opentelemetry-exporter-http-transport packages and switch default HTTP
backend to urllib3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389 ">#5389</a>)</li>
<li><code>opentelemetry-sdk</code>: unify logging force_flush timeout
defaults to 30000ms (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438 ">#5438</a>)</li>
<li><code>opentelemetry-python</code>: enable Ruff default ruleset and
fix auto-fixable lint issues (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491 ">#5491</a>)</li>
<li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now
drops spans ended after <code>shutdown()</code> instead of passing them
to the exporter, and counts them on
<code>otel.sdk.processor.span.processed</code> with
<code>error.type=already_shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512 ">#5512</a>)</li>
<li>Bump pytest to 9.0.3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518 ">#5518</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that
the <code>endpoint=</code> kwarg requires the full signal path (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633 ">#5633</a>)</li>
<li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658 ">#5658</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-configuration</code>: perform environment
variable substitution on scalar values after parsing the configuration
file, so <code>${VAR}</code> references inside comments and mapping keys
are no longer substituted and undefined references in comments no longer
abort loading (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407 ">#5407</a>)</li>
<li><code>opentelemetry-configuration</code>: declarative config
environment variable substitution now replaces an unset variable that
has no default with an empty value instead of raising an error, per the
configuration spec. Resource attributes whose value resolves to null (an
unset <code>${VAR}</code> with no default) are skipped with a warning
instead of being inserted as a null value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408 ">#5408</a>)</li>
<li>'scripts/build.sh<code>: add
</code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json`
to the package to release (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425 ">#5425</a>)</li>
<li><code>opentelemetry-sdk</code>: fix <code>View</code>
instrument-name matching so a view configured with an instrument's real
(mixed-case) name is applied; matching is now case-insensitive and
platform-independent instead of relying on <code>fnmatch</code>'s
OS-dependent case handling (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430 ">#5430</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md ">opentelemetry-api's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1 (2026-10-06)</h2>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type
aliases
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for
long running resource detectors
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default
HTTP transport so proxy environment variables such as
<code>HTTPS_PROXY</code> are
honored again
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header
and discard <code>tracestate</code> headers longer than 8192 characters
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0 (2026-09-25)</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource
attributes as metric labels
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute
values everywhere.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative
configuration — when set, maps the OTel <code>SeverityNumber</code>
value to a Python
logging level and applies it to the <code>opentelemetry</code> logger so
SDK internal
diagnostics respect the configured severity.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add
<code>log_record_limits</code> support to <code>LoggerProvider</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the
Logger API, SDK, and <code>LogRecordProcessor</code> to let
instrumentation skip
expensive work when logging is disabled
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/14971cef9c84c2354cbaf6871090896fad0f9a1a "><code>14971ce</code></a>
Prepare release 1.45.1/0.66b1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5752 ">#5752</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/44ac26edcee5cc99e03a65d6a1a9978775703e28 "><code>44ac26e</code></a>
opentelemetry-sdk: fix thread leak bug in resource initialization logic
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/570 ">#570</a>...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/a2ec3f91f1c2b735ccba177eaa77d6019a4428ae "><code>a2ec3f9</code></a>
[release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore
requ...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b "><code>d5224bf</code></a>
opentelemetry-api: improve performance of tracestate parsing (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5746 ">#5746</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5749 ">#5749</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/db61173a56475d4fa1276d16182e46b43db83b9e "><code>db61173</code></a>
Declare AnyValue and AttributeValue as explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5703 ">#5703</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5750 ">#5750</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2 "><code>4f0fcfa</code></a>
Prepare release 1.45.0/0.66b0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690 ">#5690</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9 "><code>9406f34</code></a>
opentelemetry-test-utils: add CapturingSampler for instrumentation tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681 ">#5681</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c "><code>1fe31a9</code></a>
fix: update W3CBaggagePropagator to properly handle whitespace (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680 ">#5680</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534 "><code>008b5b0</code></a>
feat(config): wire top-level attribute_limits into per-signal providers
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365 ">#5365</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1 "><code>edfad0c</code></a>
[opentelemetry-sdk] Fix overwriting of the service.instance.id which has
been...</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.39.1...v1.45.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-10-25 10:03:11 +00:00
dependabot[bot]
4136a6b763
chore(deps): bump setuptools from 83.0.0 to 84.1.0 in /libs/cli ( #9425 )
...
Bumps [setuptools](https://github.com/pypa/setuptools ) from 83.0.0 to
84.1.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/setuptools/blob/main/NEWS.rst ">setuptools's
changelog</a>.</em></p>
<blockquote>
<h1>v84.1.0</h1>
<h2>Features</h2>
<ul>
<li><code>setuptools.archive_util</code> now raises the new
<code>UnsafeMember</code> exception when
an archive member would be extracted outside of the extraction
directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding
a
quietly incomplete extraction, and matches the behavior of the standard
library's <code>tarfile</code> extraction filters.</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>Wheel.install_as_egg</code> no longer creates namespace package
directories
outside of the destination egg directory. Entries in a wheel's
<code>namespace_packages.txt</code> were split on <code>.</code> and
passed straight to
<code>os.path.join</code>, so an entry that was absolute,
drive-qualified, or UNC
discarded the destination and placed an <code>__init__.py</code> at a
path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.</p>
<p>This code path is reached only by the deprecated
<code>setup_requires</code>
mechanism when <code>setup()</code> is invoked outside a PEP 517
frontend; the
setuptools build backend never reaches it.</p>
</li>
<li>
<p><code>setuptools.archive_util</code> no longer extracts archive
members outside of the
requested extraction directory. Both the tar and zip formats specify
<code>/</code> as
the only path separator, but the guard against <code>..</code>
components split member
names on <code>/</code> alone, so a name such as
<code>..\escaped.txt</code> was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC
prefix
are now rejected on every platform, as are members whose resolved
destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.</p>
</li>
</ul>
<h1>v84.0.0</h1>
<h2>Features</h2>
<ul>
<li>Newline-separated <code>keywords</code> and
<code>platforms</code><code>pypa/setuptools#4887</code><code>old
specification <https://peps.python.org/pep-0345/> ;</code>_
separated items with spaces and the current one uses commas. (<a
href="https://redirect.github.com/pypa/setuptools/issues/4887 ">#4887</a>)</li>
<li><code>Extension</code><code>pypa/distutils#373</code><a
href="https://redirect.github.com/pypa/setuptools/issues/5022 ">#5022</a>)</li>
<li>The C compiler modules now emit log messages through their own
<code>compilers.C.*</code> loggers instead of the distutils root logger,
part of decoupling the compilers package from distutils. The logger
names are normalized to a stable <code>compilers.C.*</code> prefix so
they remain constant as the package migrates toward a standalone
<code>compilers.C</code> distribution. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5266 ">#5266</a>)</li>
<li>The C compilers gained a <code>Compiler.call</code> method -- a thin
wrapper over <code>subprocess.check_call</code> (with macOS
deployment-target env injection) that is the modern replacement for
<code>Compiler.spawn</code>. The compilers no longer depend on
<code>distutils.spawn</code>, <code>distutils.dir_util</code>,
<code>distutils.file_util</code>, <code>distutils._modified</code>, or
<code>distutils.util.execute</code>/<code>split_quoted</code>: the
generic <code>newer</code>/<code>newer_group</code> and
<code>split_quoted</code> helpers are vendored into the
<code>compilers</code> package, and
<code>Compiler.mkpath</code>/<code>move_file</code>/<code>execute</code>
are implemented directly on the standard library
(<code>os.makedirs</code>/<code>shutil.move</code>). The methods are
retained for backward compatibility. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5267 ">#5267</a>)</li>
<li>The compilers no longer depend on <code>distutils.util</code>,
<code>distutils.version</code>, <code>distutils.compat</code>, or
<code>distutils._macos_compat</code>. The platform-identification
helpers
(<code>get_platform</code>/<code>get_host_platform</code>/<code>is_mingw</code>)
now live in <code>distutils.compilers.platform.detect</code> and the
macOS deployment-target logic and <code>compiler_fixup</code> in
<code>distutils.compilers.platform.macos</code>;
<code>CygwinCCompiler.gcc_version</code> returns a
<code>packaging.version.Version</code>. <code>distutils.util</code>
re-exports the platform/macOS helpers from their new homes for backward
compatibility rather than keeping duplicate copies. (sysconfig lookups
still route through distutils pending its own decoupling.) (<a
href="https://redirect.github.com/pypa/setuptools/issues/5268 ">#5268</a>)</li>
<li>The compilers now read their build configuration from the standard
library's <code>sysconfig</code> instead of
<code>distutils.sysconfig</code>. Per-compiler customization --
previously <code>distutils.sysconfig.customize_compiler</code> -- has
moved into <code>Compiler.configure_system()</code>: a no-op on the base
class, with <code>UnixCCompiler</code> applying the
compiler/flag/archiver settings CPython recorded in
<code>sysconfig</code> (and the usual
<code>CC</code>/<code>CFLAGS</code>/<code>LDSHARED</code>/… environment
overrides). <code>distutils.sysconfig.customize_compiler</code> is
retained as a thin wrapper that calls
<code>compiler.configure_system()</code>. (<a
href="https://redirect.github.com/pypa/setuptools/issues/5269 ">#5269</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/setuptools/commit/77b7ace0aaf660beeb9b3f9da4aabf21cbcf3fa9 "><code>77b7ace</code></a>
Bump version: 84.0.0 → 84.1.0</li>
<li><a
href="https://github.com/pypa/setuptools/commit/e66004c64eaf6cf2f8c53ccdfac75cf7abce7ccf "><code>e66004c</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5329 ">#5329</a>
from pypa/fix/wheel-namespace-path-escape</li>
<li><a
href="https://github.com/pypa/setuptools/commit/54b5dcadc1bd938a5a66919e8ab7bcd59805e7fd "><code>54b5dca</code></a>
Cover the containment check with a symlink escape test</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af "><code>6d07b8d</code></a>
Validate namespace package names during legacy wheel installation</li>
<li><a
href="https://github.com/pypa/setuptools/commit/8419f006d4e34c4ecfc7a0bd1bc6993855adc3cc "><code>8419f00</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/setuptools/issues/5356 ">#5356</a>
from pypa/skeleton-ruff-0.16</li>
<li><a
href="https://github.com/pypa/setuptools/commit/6dadc86a3f7dbe1cf49c6301548ffde61d4e74e1 "><code>6dadc86</code></a>
Remove DTZ011 suppressions that Ruff 0.17 reports as unused.</li>
<li><a
href="https://github.com/pypa/setuptools/commit/715ec38b46424533806195a96983e3dd70fdf3b9 "><code>715ec38</code></a>
Merge <a
href="https://github.com/jaraco/skeleton ">https://github.com/jaraco/skeleton </a></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9695460ebfa879ada16545d62b26b9a489a6d5ed "><code>9695460</code></a><code>jaraco/skeleton#219</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/9e0812976b1154a7aece47188814385c887bc6c9 "><code>9e08129</code></a><code>jaraco/skeleton#216</code></li>
<li><a
href="https://github.com/pypa/setuptools/commit/4e612f9e44ecfad130d0b2a27a2dce0740599b4b "><code>4e612f9</code></a>
Ignore PyPy's deprecated check_home warning in tests</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:56:36 -07:00
dependabot[bot]
4f5740e53e
chore(deps): bump nbconvert from 7.17.1 to 7.17.2 in /libs/langgraph ( #9426 )
...
Bumps [nbconvert](https://github.com/jupyter/nbconvert ) from 7.17.1 to
7.17.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/releases ">nbconvert's
releases</a>.</em></p>
<blockquote>
<h2>v7.17.2</h2>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327 ">#2327</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau "><code>@Carreau</code></a>, <a
href="https://github.com/claude "><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318 ">#2318</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/minrk "><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau "><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/claude "><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/minrk "><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/Yann-P "><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md ">nbconvert's
changelog</a>.</em></p>
<blockquote>
<h2>7.17.2</h2>
<p>(<a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Fix CI: fetch the classic CSS from PyPI, update dead links <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2327 ">#2327</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/Carreau "><code>@Carreau</code></a>, <a
href="https://github.com/claude "><code>@claude</code></a>)</li>
</ul>
<h3>Other merged PRs</h3>
<ul>
<li>Use org-level security policy (jupyter/.github/SECURITY.md) <a
href="https://redirect.github.com/jupyter/nbconvert/pull/2318 ">#2318</a>
(<a href="https://github.com/Yann-P "><code>@Yann-P</code></a>, <a
href="https://github.com/minrk "><code>@minrk</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Carreau "><code>@Carreau</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/claude "><code>@claude</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/minrk "><code>@minrk</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)
| <a href="https://github.com/Yann-P "><code>@Yann-P</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues ">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/nbconvert/commit/e681152f214b65387f875aad96a4726994533a0b "><code>e681152</code></a>
Publish 7.17.2</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/8685e15e2d924fa39be38aeafb6ac859fc254ccc "><code>8685e15</code></a>
Fix CI: fetch the classic CSS from PyPI, update dead links</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f "><code>ce4bd99</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/jupyter/nbconvert/commit/1ff189e1b30f0820238e95427c035a9150a5e43f "><code>1ff189e</code></a>
Use org-level security policy (jupyter/.github/SECURITY.md) (<a
href="https://redirect.github.com/jupyter/nbconvert/issues/2318 ">#2318</a>)</li>
<li>See full diff in <a
href="https://github.com/jupyter/nbconvert/compare/v7.17.1...v7.17.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:55:35 -07:00
dependabot[bot]
225328f2f9
chore(deps): bump opentelemetry-api from 1.41.0 to 1.45.1 in /libs/cli ( #9423 )
...
Bumps
[opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python )
from 1.41.0 to 1.45.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/releases ">opentelemetry-api's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1</h2>
<p>This is a patch release on the previous 1.45.0/0.66b0 release, fixing
the issue(s) below.</p>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for long running resource detectors (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default HTTP transport so proxy environment
variables such as <code>HTTPS_PROXY</code> are honored again (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header and discard <code>tracestate</code>
headers longer than 8192 characters (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource attributes as metric labels (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute values everywhere. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative configuration — when set,
maps the OTel <code>SeverityNumber</code> value to a Python logging
level and applies it to the <code>opentelemetry</code> logger so SDK
internal diagnostics respect the configured severity. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add <code>log_record_limits</code> support to
<code>LoggerProvider</code> (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the Logger API, SDK, and
<code>LogRecordProcessor</code> to let instrumentation skip expensive
work when logging is disabled (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental
<code>tracer_configurator/development</code>,
<code>meter_configurator/development</code> and
<code>logger_configurator/development</code> fields into
<code>create_tracer_provider</code>, <code>create_meter_provider</code>
and <code>create_logger_provider</code>, so per-instrumentation-scope
<code>enabled</code> overrides declared in the config file are applied
to the provider (previously these fields were parsed but silently
discarded). The logger
<code>minimum_severity</code>/<code>trace_based</code> fields are not
supported by the Python SDK and are ignored with a warning. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418 ">#5418</a>)</li>
<li><code>docs/examples</code>: add example on how to manually setup the
SDK to get SDK metrics (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449 ">#5449</a>)</li>
<li><code>opentelemetry-docker-tests</code>: add Prometheus exporter
docker tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457 ">#5457</a>)</li>
<li><code>opentelemetry-sdk</code>: count records dropped after shutdown
on <code>otel.sdk.processor.{span,log}.processed</code> with
<code>error.type=already_shutdown</code> (batch span/log and simple log
processors), which the semantic conventions define as a valid value for
this metric. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509 ">#5509</a>)</li>
<li><code>opentelemetry-semantic-conventions</code>: update semantic
conventions to v1.44.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511 ">#5511</a>)</li>
<li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host
resource detector (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653 ">#5653</a>)</li>
<li><code>opentelemetry-test-utils</code>: add
<code>CapturingSampler</code> to record what samplers receive in
instrumentation tests (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681 ">#5681</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all
violations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150 ">#5150</a>)</li>
<li>The public <code>opentelemetry.util.types.AttributeValue</code> type
in package <code>opentelemetry-api</code> is being expanded to include
<code>None</code>, heterogeneous sequences of primitive types (and
nested sequences) as opposed to only homogeneous primitive sequences,
and Mappings of strings to any primitive types or sequences/mappings
(which themselves must only contain primitive types or
sequences/mappings validated the same way). If a <code>bytes</code> type
is set as an attribute value in the SDK, it will no longer be utf-8
decoded to a string, instead it will be passed along as is in accordance
with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP
proto. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: add a
<code>max_request_size</code> argument to the OTLP HTTP exporters
(traces, logs, metrics); serialized requests larger than the limit are
dropped before sending, measured before compression. Defaults to 64 MiB
(enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369 ">#5369</a>)</li>
<li>[BREAKING] <code>opentelemetry-api</code>: subclasses of
<code>Logger</code> need to implement the <code>enabled</code> method
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use
shared opentelemetry-exporter-otlp-common and
opentelemetry-exporter-http-transport packages and switch default HTTP
backend to urllib3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389 ">#5389</a>)</li>
<li><code>opentelemetry-sdk</code>: unify logging force_flush timeout
defaults to 30000ms (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438 ">#5438</a>)</li>
<li><code>opentelemetry-python</code>: enable Ruff default ruleset and
fix auto-fixable lint issues (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491 ">#5491</a>)</li>
<li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now
drops spans ended after <code>shutdown()</code> instead of passing them
to the exporter, and counts them on
<code>otel.sdk.processor.span.processed</code> with
<code>error.type=already_shutdown</code>. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512 ">#5512</a>)</li>
<li>Bump pytest to 9.0.3 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518 ">#5518</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that
the <code>endpoint=</code> kwarg requires the full signal path (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633 ">#5633</a>)</li>
<li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658 ">#5658</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-configuration</code>: perform environment
variable substitution on scalar values after parsing the configuration
file, so <code>${VAR}</code> references inside comments and mapping keys
are no longer substituted and undefined references in comments no longer
abort loading (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407 ">#5407</a>)</li>
<li><code>opentelemetry-configuration</code>: declarative config
environment variable substitution now replaces an unset variable that
has no default with an empty value instead of raising an error, per the
configuration spec. Resource attributes whose value resolves to null (an
unset <code>${VAR}</code> with no default) are skipped with a warning
instead of being inserted as a null value. (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408 ">#5408</a>)</li>
<li>'scripts/build.sh<code>: add
</code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json`
to the package to release (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425 ">#5425</a>)</li>
<li><code>opentelemetry-sdk</code>: fix <code>View</code>
instrument-name matching so a view configured with an instrument's real
(mixed-case) name is applied; matching is now case-insensitive and
platform-independent instead of relying on <code>fnmatch</code>'s
OS-dependent case handling (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430 ">#5430</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md ">opentelemetry-api's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.45.1/0.66b1 (2026-10-06)</h2>
<h3>Fixed</h3>
<ul>
<li><code>opentelemetry-api</code>: make <code>AnyValue</code> and
<code>AttributeValue</code> explicit type
aliases
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5703 ">#5703</a>)</li>
<li><code>opentelemetry-sdk</code>: fix thread leak bug in resource
initialization logic for
long running resource detectors
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5706 ">#5706</a>)</li>
<li><code>opentelemetry-exporter-otlp-proto-http</code>: restore
<code>requests</code> as the default
HTTP transport so proxy environment variables such as
<code>HTTPS_PROXY</code> are
honored again
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5714 ">#5714</a>)</li>
<li><code>opentelemetry-api</code>: fix quadratic time parsing of the
<code>tracestate</code> header
and discard <code>tracestate</code> headers longer than 8192 characters
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5746 ">#5746</a>)</li>
</ul>
<h2>Version 1.45.0/0.66b0 (2026-09-25)</h2>
<h3>Added</h3>
<ul>
<li><code>opentelemetry-exporter-prometheus</code>: add support to
configure Resource
attributes as metric labels
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122 ">#5122</a>)</li>
<li>infra: add renovate
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202 ">#5202</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
support for extended attribute
values everywhere.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266 ">#5266</a>)</li>
<li><code>opentelemetry-sdk</code>: wire the top-level
<code>log_level</code> field in declarative
configuration — when set, maps the OTel <code>SeverityNumber</code>
value to a Python
logging level and applies it to the <code>opentelemetry</code> logger so
SDK internal
diagnostics respect the configured severity.
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351 ">#5351</a>)</li>
<li><code>opentelemetry-sdk</code>: add the new stable
<code>AlwaysRecordSampler</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354 ">#5354</a>)</li>
<li><code>opentelemetry-configuration</code>,
<code>opentelemetry-sdk</code>: wire top-level
<code>attribute_limits</code> into per-signal providers via declarative
config; add
<code>log_record_limits</code> support to <code>LoggerProvider</code>
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365 ">#5365</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON
HTTP exporter package
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374 ">#5374</a>)</li>
<li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add
<code>enabled()</code> support to the
Logger API, SDK, and <code>LogRecordProcessor</code> to let
instrumentation skip
expensive work when logging is disabled
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380 ">#5380</a>)</li>
<li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON
file Docker tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412 ">#5412</a>)</li>
<li><code>opentelemetry-configuration</code>: wire the experimental</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/14971cef9c84c2354cbaf6871090896fad0f9a1a "><code>14971ce</code></a>
Prepare release 1.45.1/0.66b1 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5752 ">#5752</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/44ac26edcee5cc99e03a65d6a1a9978775703e28 "><code>44ac26e</code></a>
opentelemetry-sdk: fix thread leak bug in resource initialization logic
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/570 ">#570</a>...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/a2ec3f91f1c2b735ccba177eaa77d6019a4428ae "><code>a2ec3f9</code></a>
[release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore
requ...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b "><code>d5224bf</code></a>
opentelemetry-api: improve performance of tracestate parsing (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5746 ">#5746</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5749 ">#5749</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/db61173a56475d4fa1276d16182e46b43db83b9e "><code>db61173</code></a>
Declare AnyValue and AttributeValue as explicit type aliases (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5703 ">#5703</a>)
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5750 ">#5750</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2 "><code>4f0fcfa</code></a>
Prepare release 1.45.0/0.66b0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690 ">#5690</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9 "><code>9406f34</code></a>
opentelemetry-test-utils: add CapturingSampler for instrumentation tests
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681 ">#5681</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c "><code>1fe31a9</code></a>
fix: update W3CBaggagePropagator to properly handle whitespace (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680 ">#5680</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534 "><code>008b5b0</code></a>
feat(config): wire top-level attribute_limits into per-signal providers
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365 ">#5365</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1 "><code>edfad0c</code></a>
[opentelemetry-sdk] Fix overwriting of the service.instance.id which has
been...</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.41.0...v1.45.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-25 02:55:05 -07:00
Elior Nataf Lackritz
4c52e129eb
release(langgraph): 1.2.17 ( #9418 )
...
Bumps langgraph from 1.2.16 to 1.2.17.
Includes:
- Apply an explicit `recursion_limit` equal to the default (#9417 )
- Keep the caller's namespace in `RemoteGraph.stream(subgraphs=True)`
(#9401 )
2026-10-24 01:02:32 +00:00
Elior Nataf Lackritz
6c4ceb1332
fix(langgraph): apply an explicit recursion_limit equal to the default ( #9417 )
...
Fixes #9416 .
`merge_configs` decided whether a `recursion_limit` was set by comparing
it with `DEFAULT_RECURSION_LIMIT`, so an explicit limit equal to the
default was dropped. `LANGGRAPH_DEFAULT_RECURSION_LIMIT` sets that
default, so with it at 1000, `agent.with_config(recursion_limit=1000)`
silently kept the 9999 that `create_agent` and `create_deep_agent` bind,
and a looping agent ran to 9999 steps.
The default is now a sentinel, as #7313 proposed: `ensure_config` fills
in one `int` subclass instance, and `merge_configs` skips that exact
object instead of any equal value. The filled-in default still never
overrides a bound limit (a subgraph bound to 50 keeps 50 when its parent
runs at the default), while an explicit limit equal to the default now
applies wherever configs are merged: `with_config`, `RemoteGraph` calls,
and the limit a parent passes to its subgraphs.
langchain-core has the same check in its own `merge_configs`
(langchain-ai/langchain#39994 ); this PR does not touch it.
Thanks @awg66 for the report and the repro.
2026-10-24 00:56:19 +00:00
Elior Nataf Lackritz
4897c51365
fix(langgraph): keep the caller's namespace in RemoteGraph.stream(subgraphs=True) ( #9401 )
...
`RemoteGraph.stream(..., subgraphs=True)` and `astream` dropped the
caller's namespace prefix from the events they yield. Called inside a
node of a graph running under `outer:123`, a remote subgraph event came
back as `("sub:abc",)` instead of `("outer:123", "sub:abc")`, while the
events RemoteGraph pushes to the parent graph's stream, and an in-memory
subgraph streamed the same way, keep the prefix. Fixes #6604 .
The `subgraphs` branch parsed the namespace from the event name a second
time, after the caller prefix was added. This removes that second parse
in `stream` and `astream`.
The new tests fail on `main`.
Same fix as #6605 by @Rakshit-gen.
Co-authored-by: Rakshit Sisodiya
<64471316+rakshit-gen@users.noreply.github.com >
2026-10-23 19:24:04 -04:00
ataller-lc
eb066bd31a
release(cli): 0.4.38 ( #9411 )
...
Bumps the CLI to 0.4.38 to cut a release including #9393 (the `priority`
section in `langgraph.json`), the only CLI change merged since 0.4.37.
The section takes effect with `langgraph-api` 0.18.0 or later; older
servers ignore it, and configs without it build the same images as
before.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-23 14:18:08 +00:00
ataller-lc
6b83b9b019
release(sdk-py): 0.4.9 ( #9398 )
...
Bumps the Python SDK version from 0.4.8 to 0.4.9. Adds `Priority`
(beta), which lets a deployment set each thread's priority settings in
its own code (#9392 ); it needs `langgraph-api` 0.18.0 or later and a
`langgraph-cli` that supports the `priority` section. Also picks up the
`certifi` bump (#9370 ).
2026-10-23 09:32:43 -04:00
ataller-lc
9d68e5b3eb
feat(cli): add the priority section to langgraph.json ( #9393 )
...
`langgraph.json` gets a `priority` section that names a `Priority`
object from `langgraph_sdk` (#9392 ), as `auth` and `encryption` name
theirs:
```json
"priority": {"path": "./priority.py:priority"}
```
- The path must be `file.py:name` or `module:name`, as for `encryption`.
It must point to Python: JavaScript and TypeScript files are rejected. A
Node.js-only project can still name a Python file, since the callback
runs in the Python server, as `encryption` does.
- Image builds rewrite the path to its location in the image, for both
`dependencies`-based and `uv`-source projects, and write `ENV
LANGGRAPH_PRIORITY` into the Dockerfile.
- `langgraph dev` passes `priority` to the server. A server that doesn't
read the section ignores it.
- `PriorityConfig` is in the JSON schema (`make update-schema`).
## Test plan
- [x] New unit tests next to the `encryption` ones: `LANGGRAPH_PRIORITY`
with the rewritten path from both builders, a path outside
`dependencies`, a malformed path, the six JS and TS extensions, a
Node.js-only project with a Python path, the section kept by validation
and not reported as unknown, and `langgraph dev` passing it to the
server. Each one fails when the change it covers is removed.
- [x] `make test` in `libs/cli`: 586 passed. `make lint` clean, and
`make update-schema` leaves no diff.
2026-10-22 17:26:01 -04:00
ataller-lc
544386f6cc
feat(sdk-py): add Priority for thread priority settings ( #9392 )
...
`Priority` lets a deployment decide each thread's run priority in its
own code, declared the way `Auth` and `Encryption` are: an object in the
project, named by a `priority` section in `langgraph.json`. It's beta,
and construction warns like `Encryption()` does.
```python
from langgraph_sdk import Priority, PriorityContext, PrioritySettings
priority = Priority()
@priority.assign
async def assign(ctx: PriorityContext) -> PrioritySettings | None:
return {"priority": 3 if "premium" in ctx.permissions else 0}
```
- The server calls the function at the first run on a thread with no
settings and stores what it returns on the thread. Later runs on the
thread use the stored settings.
- `PriorityContext` is a frozen dataclass: the user and their
permissions, the thread's ID (`None` when the run creates its thread
without one) and metadata, the assistant and graph IDs, the assistant's
and the run's metadata, and the cron ID when a cron started the run.
- `PrioritySettings` has three optional keys: `priority` (-5 to 5, 5
runs first), `fairness_group` (a non-empty string, stored unencrypted,
so an opaque ID rather than personal data) and `fairness_weight` (1 to
100). A missing key, `None`, or a `None` return takes the default: 0,
`"default"`, 1.
- `@priority.assign` takes one async function with one parameter and
raises on a second registration. It reuses `DuplicateHandlerError` and
`LangGraphBetaWarning` from `langgraph_sdk.encryption`.
- `Priority`, `PriorityContext` and `PrioritySettings` are exported from
`langgraph_sdk`; the types are also on `Priority.types`.
## Test plan
- [x] New unit tests in `tests/test_priority.py`: registration and its
checks, the exports, a frozen context that accepts `thread_id=None`,
every settings key optional, the beta warning. Each one fails when the
check it covers is removed.
- [x] `make test` in `libs/sdk-py`: 561 passed. `make lint` clean,
`check_sdk_methods.py` passes.
2026-10-22 17:25:38 -04:00
c2df8ab04b
chore(deps): remove precautionary third-party upper bounds ( #9390 )
...
Remove only the precautionary `websockets<17` ceiling from
`langgraph-sdk`, keeping `websockets>=14` and every first-party
dependency range unchanged. Refresh mirrored lock metadata without
changing resolved versions, Python support, or development/build
constraints.
AI assistance: implemented with Open SWE.
## References
-
[Plan](https://openswe.langchain.dev/agents/8ca5d7fe-ecc3-5d70-9b14-d2904a2c0948/plan )
- [Slack
thread](https://langchain.slack.com/archives/C0C5950ARJT/p1792630605250939 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/8ca5d7fe-ecc3-5d70-9b14-d2904a2c0948 )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Mason Daugherty <mdrxy@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-22 16:27:58 -04:00
3cd57c038a
fix(checkpoint): reject NUL bytes in namespace labels ( #9383 )
...
Reject NUL bytes in namespace labels with `InvalidNamespaceError` to
prevent SQLite GLOB truncation from bypassing namespace segment
boundaries. Add shared sync/async validation coverage and a SQLite
regression for public search and direct batch operations against
in-memory and file-backed stores.
## References
- [Slack
thread](https://langchain.slack.com/archives/D0B5PRNJA05/p1792583492031829 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/9499abf7-c3c8-5004-ac28-fe55d4955ae6 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-21 21:22:40 +09:00
dependabot[bot]
4098bb138c
chore(deps): bump uv from 0.11.15 to 0.13.4 in /libs/cli ( #9366 )
...
Bumps [uv](https://github.com/astral-sh/uv ) from 0.11.15 to 0.13.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases ">uv's
releases</a>.</em></p>
<blockquote>
<h2>0.13.4</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-20.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62 ">GHSA-hq85-5cpj-mr62</a>,
which involves a root CA whose intermediate on the Web PKI have been
compromised. Users are encouraged to upgrade immediately, as well as
confirm that all other software that uses bundled CAs is also properly
updated.</p>
<h3>Preview features</h3>
<ul>
<li>Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22512 ">#22512</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Update the bundled Mozilla root certificates via
<code>webpki-root-certs</code> 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22760 ">#22760</a>)</li>
</ul>
<h2>Install uv 0.13.4</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-installer.ps1
| iex"
</code></pre>
<h2>Download uv 0.13.4</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz ">uv-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz ">uv-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-apple-darwin.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip ">uv-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-pc-windows-msvc.zip ">uv-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip ">uv-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-pc-windows-msvc.zip.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz ">uv-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-gnu.tar.gz ">uv-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-powerpc64le-unknown-linux-gnu.tar.gz ">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-gnu.tar.gz ">uv-riscv64gc-unknown-linux-gnu.tar.gz</a></td>
<td>RISCV Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-s390x-unknown-linux-gnu.tar.gz ">uv-s390x-unknown-linux-gnu.tar.gz</a></td>
<td>S390x Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-s390x-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz ">uv-x86_64-unknown-linux-gnu.tar.gz</a></td>
<td>x64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-armv7-unknown-linux-gnueabihf.tar.gz ">uv-armv7-unknown-linux-gnueabihf.tar.gz</a></td>
<td>ARMv7 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz ">uv-aarch64-unknown-linux-musl.tar.gz</a></td>
<td>ARM64 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-musl.tar.gz ">uv-i686-unknown-linux-musl.tar.gz</a></td>
<td>x86 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-i686-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-musl.tar.gz ">uv-riscv64gc-unknown-linux-musl.tar.gz</a></td>
<td>RISCV MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz ">uv-x86_64-unknown-linux-musl.tar.gz</a></td>
<td>x64 MUSL Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-musl.tar.gz.sha256 ">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-arm-unknown-linux-musleabihf.tar.gz ">uv-arm-unknown-linux-musleabihf.tar.gz</a></td>
<td>ARMv6 MUSL Linux (Hardfloat)</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.13.4/uv-arm-unknown-linux-musleabihf.tar.gz.sha256 ">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md ">uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.13.4</h2>
<p>Released on 2026-10-20.</p>
<h3>Preview features</h3>
<ul>
<li>Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22512 ">#22512</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Update the bundled Mozilla root certificates via
<code>webpki-root-certs</code> 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22760 ">#22760</a>)</li>
</ul>
<h2>0.13.3</h2>
<p>Released on 2026-10-20.</p>
<h3>Performance</h3>
<ul>
<li>Avoid severe <code>uv export</code> slowdowns in dependency graphs
with extras (<a
href="https://redirect.github.com/astral-sh/uv/pull/22750 ">#22750</a>)</li>
</ul>
<h2>0.13.2</h2>
<p>Released on 2026-10-19.</p>
<h3>Enhancements</h3>
<ul>
<li>Report all installed packages in <code>uv workspace metadata</code>,
including packages outside the selected resolution (<a
href="https://redirect.github.com/astral-sh/uv/pull/22395 ">#22395</a>)</li>
<li>Include supported environment restrictions when exporting
<code>pylock.toml</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22596 ">#22596</a>)</li>
<li>Retry dropped GET and HEAD requests when fetching package and index
data (<a
href="https://redirect.github.com/astral-sh/uv/pull/22672 ">#22672</a>)</li>
<li>Preserve encoding declarations in wheel data scripts that require
shell launchers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22526 ">#22526</a>)</li>
<li>Show causes and hints when <code>uv python find --script</code>
cannot discover an interpreter, including with <code>-q</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22549 ">#22549</a>)</li>
<li>Print valid ksh activation instructions and support non-relocatable
environments under OpenBSD-derived ksh (<a
href="https://redirect.github.com/astral-sh/uv/pull/22538 ">#22538</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22572 ">#22572</a>)</li>
<li>Allow PEP 508 direct URLs, including Mercurial and extensionless
archive URLs, in uv-build's <code>[build-system].requires</code>
validation (<a
href="https://redirect.github.com/astral-sh/uv/pull/22577 ">#22577</a>)</li>
</ul>
<h3>Python</h3>
<ul>
<li>Add PyPy 3.11.17 and 3.12.15 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22578 ">#22578</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Fetch and parse PEP 825 index-level variant metadata with
<code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22509 ">#22509</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22511 ">#22511</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid exponential work when simplifying, traversing, and exporting
complex dependency markers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22608 ">#22608</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22615 ">#22615</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22651 ">#22651</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22674 ">#22674</a>)</li>
<li>Reduce the time and memory used to parse and store complex
dependency markers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22675 ">#22675</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22676 ">#22676</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22681 ">#22681</a>)</li>
<li>Reduce resolver memory use for large dependency graphs, forks,
extras, and dependency groups (<a
href="https://redirect.github.com/astral-sh/uv/pull/22565 ">#22565</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22625 ">#22625</a>)</li>
<li>Speed up project discovery in large workspaces by caching member
names (<a
href="https://redirect.github.com/astral-sh/uv/pull/22635 ">#22635</a>)</li>
<li>Reduce uv's binary size and speed up CycloneDX exports (<a
href="https://redirect.github.com/astral-sh/uv/pull/22431 ">#22431</a>)</li>
<li>Reduce <code>uv-build</code> binary size, including Linux x86_64
wheels (<a
href="https://redirect.github.com/astral-sh/uv/pull/22539 ">#22539</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22573 ">#22573</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/7456b60bc6bc348e13e06e3691bf08e78d3aef54 "><code>7456b60</code></a>
Bump version to 0.13.4 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22761 ">#22761</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0a7aa9ddf7009f6a7c5496eb7036ec7e93527ef7 "><code>0a7aa9d</code></a>
Switch back to env::args_os (<a
href="https://redirect.github.com/astral-sh/uv/issues/22763 ">#22763</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5bae848da3626fe9c6a2463339752e11666d37ae "><code>5bae848</code></a>
Update certifi to 2026.10.19 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22762 ">#22762</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/158c9d35c592747ab6e94d4e66a0bb8f1b387c0c "><code>158c9d3</code></a>
Bump webpki-root-certs to 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22760 ">#22760</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5280ad3833e0a714a5a95ba435ff22419fc60843 "><code>5280ad3</code></a>
Parse and validate variant metadata (<a
href="https://redirect.github.com/astral-sh/uv/issues/22512 ">#22512</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/8d1626698d1ad5eafd7d4427a4d893fc7c0d3960 "><code>8d16266</code></a>
Use indoc for multiline test strings (<a
href="https://redirect.github.com/astral-sh/uv/issues/22723 ">#22723</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/502f93ca6145cbc78bfb9dd6bb37fa05340be0b3 "><code>502f93c</code></a>
Bump version to 0.13.3 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22752 ">#22752</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0595a1120c1bbc71c89bf99b3c9b1edb7a37fc79 "><code>0595a11</code></a>
Revert optional-extra activation tracking in exports (<a
href="https://redirect.github.com/astral-sh/uv/issues/22750 ">#22750</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b2eb713620a60e4314df8647f93ddca2bd357820 "><code>b2eb713</code></a>
Deserialize build metadata contacts in one pass (<a
href="https://redirect.github.com/astral-sh/uv/issues/22748 ">#22748</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b98692400b73dc7236be47647e03f5d755b7525a "><code>b986924</code></a>
Borrow the uv-build command argument (<a
href="https://redirect.github.com/astral-sh/uv/issues/22747 ">#22747</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.11.15...0.13.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:39:47 +01:00
dependabot[bot]
6f874e9878
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/langgraph ( #9375 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:12:01 +01:00
dependabot[bot]
7d9a670710
chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in /libs/cli ( #9374 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.2.25 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:55 +01:00
dependabot[bot]
c6b7486550
chore(deps): bump the uv group across 2 directories with 1 update ( #9373 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory: [certifi](https://github.com/certifi/python-certifi ).
Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple
directory: [certifi](https://github.com/certifi/python-certifi ).
Updates `certifi` from 2026.2.25 to 2026.10.19
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `certifi` from 2026.5.20 to 2026.10.19
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:49 +01:00
dependabot[bot]
9c1a4efc96
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint ( #9372 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:43 +01:00
dependabot[bot]
283855b817
chore(deps): bump certifi from 2026.4.22 to 2026.10.19 in /libs/checkpoint-conformance ( #9371 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.4.22 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.04.22...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:37 +01:00
dependabot[bot]
8c10fbdc04
chore(deps): bump certifi from 2026.2.25 to 2026.10.19 in /libs/sdk-py ( #9370 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from
2026.2.25 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:30 +01:00
dependabot[bot]
a3ca41eb1b
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint-postgres ( #9369 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:23 +01:00
dependabot[bot]
264535917f
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/checkpoint-sqlite ( #9368 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:11:17 +01:00
dependabot[bot]
4de8792dc4
chore(deps): bump certifi from 2026.1.4 to 2026.10.19 in /libs/prebuilt ( #9367 )
...
Bumps [certifi](https://github.com/certifi/python-certifi ) from 2026.1.4
to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914 "><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439 ">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440 ">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8 "><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437 ">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6 "><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436 ">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536 "><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435 ">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6 "><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432 ">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c "><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431 ">#431</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f4bc676bc101fe2235846e37044e8c693d6cbaf4 "><code>f4bc676</code></a>
2026.07.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/428 ">#428</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4c91f9c5f9b4676d40d2930025ba04d80dd536f6 "><code>4c91f9c</code></a>
Bump actions/setup-python from 6.3.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/427 ">#427</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/01a66c5cf32eadb8f03a0504c24cb44f6d581248 "><code>01a66c5</code></a>
Bump actions/checkout from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/426 ">#426</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/eb355f41cb71f71012ecf1a4d27a57d0ee2b1337 "><code>eb355f4</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/425 ">#425</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2026.01.04...2026.10.19 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-21 12:10:39 +01:00
a24fc97778
fix(cli): patch missed brace-expansion dependency majors ( #9360 )
...
Patch the remaining 1.x and 2.x copies covered by
[GHSA-q2hr-2g5m-vwhr](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr ),
which were not addressed by #9349 . Regenerate both CLI fixture locks
with their declared Yarn 1.22.22: 1.1.11/1.1.12 → 1.1.21 and 2.0.2 →
2.1.7, retaining 5.0.12 with no new packages or manifest changes.
Verification:
- Both fixtures: `yarn install --frozen-lockfile --ignore-scripts
--non-interactive` and `yarn check --integrity --ignore-scripts` passed.
- Local Node regression harness: 16 checks passed across all installed
brace-expansion and real minimatch 3/9/10 consumers, including normal
expansion/matching and advisory-shaped DoS payloads with a three-second
subprocess deadline (direct 128k braces; minimatch 64k braces).
- Every tracked text file scanned for brace-expansion; all five resolved
lock entries are outside all four current advisory ranges. No additional
repository copies found.
- `git diff --check` passed; only three generated version/URL/integrity
triplets changed.
Lifecycle scripts and the full suite were intentionally not run.
Existing peer-dependency warnings remain, including the checkpoint
resolution mismatch in js-examples; dependency-graph ingestion and alert
status were not refreshed or claimed resolved.
## References
-
[Plan](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846/plan )
- [Slack
thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-20 11:09:26 +01:00
Elior Nataf Lackritz
1400d25b7b
release(cli): 0.4.37 ( #9351 )
...
Bumps the CLI to 0.4.37 to cut a release including #9333 (`langgraph
deploy` defaults to serverless) and #9350 (`--verbose` no longer prints
subprocess stdin), the two CLI changes merged since 0.4.36.
Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`.
2026-10-19 10:03:29 -04:00
Elior Nataf Lackritz
7b23a10846
fix(cli): stop printing subprocess stdin in verbose output ( #9350 )
...
`--verbose` printed each subprocess command followed by everything piped
to its stdin, which can hold credentials. It now prints only the command
line, so `langgraph up --verbose`, `langgraph build` and `langgraph
deploy --verbose` no longer show the generated compose file or
Dockerfile (`langgraph dockerfile` still writes the Dockerfile out).
2026-10-19 13:45:42 +00:00
8b9c1a1301
Merge PR #9349
...
Update brace-expansion from 5.0.9 to 5.0.12 in both CLI JavaScript
example lockfiles to address CVE-2026-102277. Existing dependency ranges
already allow the patched version; no manifests or runtime code change.
Verification: generated the replacement entries with the declared Yarn
1.22.22 in an isolated dependency fixture, then checked basic
brace/range expansion and `git diff --check`. Full example installs were
attempted but blocked by registry.yarnpkg.com DNS/timeouts, including
with npm selected as the registry; only the authentic generated package
entries were transferred, preserving unrelated resolutions. Full package
lint/tests were not run and CI is not claimed.
## References
- [Slack
thread](https://langchain.slack.com/archives/D0C00MN8BR8/p1792399312164349 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/07fb6bc4-65cc-5511-a329-5db31424d846 )
· openai:gpt-6.1-sol (medium)
Co-authored-by: Vladislav Nechakhin <vladislav-nechakhin@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-19 21:47:25 +09:00
98043c37ab
fix(cli): default deploy to serverless ( #9333 )
...
- Default new deployments to serverless, preserving explicit
deployment-type overrides.
- Let the backend determine AWS serverless availability; preserve its
rejection and append guidance to use --deployment-type dev. Do not
detect AWS hostnames, block attempts locally, or silently fall back.
- Serverless deployment on AWS works without another CLI change once the
backend supports it.
## References
- [Slack
thread](https://langchain.slack.com/archives/C0BHM1C5R5L/p1792175194359579 )
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.langchain.dev/agents/c71525bc-e760-503e-b187-6997859056c1 )
· openai:gpt-6.1-sol (medium)
---------
Co-authored-by: Hari Dhanushkodi <hari-dhanushkodi@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-18 15:18:50 -04:00
0870f5efce
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 9 updates ( #9152 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.9` | `1.2.13` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.13` | `1.4.18` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc ) | `3.3.6` |
`3.3.7` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.68.0` | `8.70.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.68.0` | `8.70.1` |
| [eslint](https://github.com/eslint/eslint ) | `10.9.1` | `10.11.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest ) |
`30.5.0` | `30.5.2` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.6` | `3.9.9` |
| [ts-jest](https://github.com/kulshekhar/ts-jest ) | `29.4.12` |
`29.4.14` |
Updates `@langchain/core` from 1.2.9 to 1.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.13</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11714 ">#11714</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1 "><code>a83dfb1</code></a>
Thanks <a href="https://github.com/ccurme "><code>@ccurme</code></a>! -
Abbreviate long tool-call IDs when formatting chat messages as strings,
keeping original messages unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.12</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11675 ">#11675</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/030a726639e0147488bc8c23c063a2e72b004c2e "><code>030a726</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Preserve structured tool arguments in tracer run inputs.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11603 ">#11603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/fec9cd87b01976014dd549bd2cf7849aee89a566 "><code>fec9cd8</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- fix(core): build streaming <code>llmOutput.tokenUsage</code> from the
fully-accumulated chunk instead of whichever individual chunk's
<code>usage_metadata</code> arrived last</p>
<p>Affects both core streaming paths —
<code>.stream()</code>/<code>.streamEvents()</code>
(<code>_streamIterator</code>) and
<code>.invoke()</code>/<code>.generate()</code> when a
streaming-preferring callback is attached
(<code>_generateWithCache</code>'s <code>hasStreamingHandler</code>
branch). Previously, <code>llmOutput.tokenUsage</code> was overwritten
by each chunk in turn, so only the last chunk carrying
<code>usage_metadata</code> won — correct for providers that emit one
cumulative total on a final chunk, but wrong for providers (e.g.
<code>@langchain/google</code>, <code>@langchain/anthropic</code>) that
emit <code>usage_metadata</code> as a per-chunk delta across multiple
chunks, where the values must be summed.</p>
<p>Note for provider authors: this assumes each streamed chunk's
<code>usage_metadata</code> is either a per-chunk delta or appears only
on a single final chunk. A provider that instead repeats a cumulative
total on every chunk will now see it summed (and inflated) in
<code>llmOutput.tokenUsage</code>, matching the existing behavior of the
correctly-working <code>message.usage_metadata</code> field.</p>
<p>Also fixes <code>@langchain/google</code>'s <code>invoke({streaming:
true})</code> path (no streaming-preferring callback attached), where
<code>llmOutput</code> was never populated at all.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11590 ">#11590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ffebdc2f00f3290d19f85e5afd6a297920ae584c "><code>ffebdc2</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- Fix OpenAI Responses API replay under Zero Data Retention when a
response contains more than one reasoning item, for both v0 and v1. In
v0, the default replay path now reuses
<code>response_metadata.output</code> directly, preserving every
reasoning item's <code>id</code>/<code>encrypted_content</code> in
original order. In v1, <code>AIMessage.contentBlocks</code>
(<code>outputVersion: "v1"</code>) is fixed the same way.
<code>additional_kwargs.reasoning</code> is unchanged.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10047 ">#10047</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ff1248fd49dacdb35f5da128278cd777068481d7 "><code>ff1248f</code></a>
Thanks <a
href="https://github.com/afirstenberg "><code>@afirstenberg</code></a>!
- fix(core): BaseMessage.text use contentBlocks</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8d12783ecc31a0816f3a47da1040fbd3c08fdbc "><code>c8d1278</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11729 ">#11729</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5d509ad4b8a5ed9dd4b83020b4c103ac8a69859c "><code>5d509ad</code></a>
fix(openai): send in-memory prompt cache retention as in_memory (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11735 ">#11735</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/663b9a2076c5b274435c77524ad7730450b34f34 "><code>663b9a2</code></a>
feat(openai): support explicit prompt caching (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11232 ">#11232</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7735b219221d6ae63eb5445fb67d26c18fce9c46 "><code>7735b21</code></a>
chore(infra): drop held mcp-adapters 2.0 changeset to unblock main
releases (...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/34edee1153f0fa40ba6997c8ff7bd45834ca8ce8 "><code>34edee1</code></a>
fix(langchain): return failed returnDirect tool calls to the model (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11712 ">#11712</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0fcb98b4306a771c940e78d6881d0be9f88507c1 "><code>0fcb98b</code></a>
fix(textsplitters): use char length for loc.lines with custom
lengthFunction ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e4a3d1bd0c6753d4e1739a7f10064f48e6bc49ec "><code>e4a3d1b</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11683 ">#11683</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a9ada857f22c4b746801e7723ffaa4c4d59db771 "><code>a9ada85</code></a>
fix(openai): send tool result images so the model can see them (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11690 ">#11690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/485d030054ff599beea7d1070d87cac22bcef3cc "><code>485d030</code></a>
chore(mcp-adapters): hold the adapter out of releases until 2.0 is ready
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11 ">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1 "><code>a83dfb1</code></a>
fix(core): abbreviate long tool IDs in buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11714 ">#11714</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.9...@langchain/core@1.2.13 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.13 to 1.4.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.18-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0-rc.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.17</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861 ">#2861</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
Thanks <a href="https://github.com/casparb "><code>@casparb</code></a>!
- Add <code>GraphCallbackHandler</code> with typed
<code>handleInterrupt</code> and <code>handleResume</code> events
through normal callback configuration, matching Python graph lifecycle
behavior. Lifecycle callbacks are awaited before terminal chain
callbacks and work independently of stream mode.</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.16</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824 ">#2824</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- feat(langgraph): add <code>responseSchema</code> option to
<code>interrupt()</code></p>
<p><code>interrupt(value, { responseSchema })</code> lets a graph
declare the shape of the
value it expects on resume. A Zod schema validates the resume value and
the
parsed result is what <code>interrupt()</code> returns; a raw JSON
Schema object is passed
through as-is. The schema is surfaced on
<code>Interrupt.response_schema</code> so clients
such as Studio can render a typed form instead of a free-form JSON
editor.
Omitting the option keeps today's behavior.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.1</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.15</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
<p>Matches Python's callback-level behavior: transforms also affect
chain events and message streaming, so omitting outputs can suppress
messages returned directly by nodes and omitting inputs can affect
message deduplication.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a "><code>11a4535</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a "><code>4fc118f</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69 "><code>db4bdad</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22 "><code>55fa26b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.15-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>]:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.18</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0</li>
</ul>
</li>
</ul>
<h2>1.4.18-rc.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/7a12289df4ed6441171ec393da4ccfccd98d69e8 "><code>7a12289</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.12.0-rc.0</li>
</ul>
</li>
</ul>
<h2>1.4.17</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2861 ">#2861</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
Thanks <a href="https://github.com/casparb "><code>@casparb</code></a>!
- Add <code>GraphCallbackHandler</code> with typed
<code>handleInterrupt</code> and <code>handleResume</code> events
through normal callback configuration, matching Python graph lifecycle
behavior. Lifecycle callbacks are awaited before terminal chain
callbacks and work independently of stream mode.</li>
</ul>
<h2>1.4.16</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2824 ">#2824</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
Thanks <a href="https://github.com/eliornl "><code>@eliornl</code></a>!
- feat(langgraph): add <code>responseSchema</code> option to
<code>interrupt()</code></p>
<p><code>interrupt(value, { responseSchema })</code> lets a graph
declare the shape of the
value it expects on resume. A Zod schema validates the resume value and
the
parsed result is what <code>interrupt()</code> returns; a raw JSON
Schema object is passed
through as-is. The schema is surfaced on
<code>Interrupt.response_schema</code> so clients
such as Studio can render a typed form instead of a free-form JSON
editor.
Omitting the option keeps today's behavior.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.1</li>
</ul>
</li>
</ul>
<h2>1.4.15</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2794 ">#2794</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/83a4b62be99488f17f3d7370a064f635e7c05a2e "><code>83a4b62</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
feat(langgraph): add per-node <code>tracePolicy</code> input/output
processors and <code>omitPayload</code></p>
<p>Transform the payloads recorded on a node's own trace run while
retaining its span and timing. Processors receive raw values and fall
back to the original payload if they throw. Graph state, root runs, and
child runs remain unchanged when processors do not mutate their
arguments.</p>
<p>Matches Python's callback-level behavior: transforms also affect
chain events and message streaming, so omitting outputs can suppress
messages returned directly by nodes and omitting inputs can affect
message deduplication.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/3234c69530416e2709bf54c53472e640864e7de4 "><code>3234c69</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/11a4535762b04f8f28cc98eb7b1e4b682b69e91a "><code>11a4535</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/2fab6fda74714cd792fed24e5416cec66fdbc105 "><code>2fab6fd</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/4fc118fcde8fd6d977c03c8a0a7071912df1873a "><code>4fc118f</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/db4bdad61ddfc6c1113269b131ac2efde3eecf69 "><code>db4bdad</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/55fa26be9290fbd89a6e0acb232f04cbc6dedb22 "><code>55fa26b</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.11.0</li>
</ul>
</li>
</ul>
<h2>1.4.15-rc.0</h2>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec8cb378e3c7846b2a4aea31dfc4aff8f1cbf2fb "><code>ec8cb37</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2870 ">#2870</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/285ed3d60c51a90c2d5698f617d6ad7ce3048ef2 "><code>285ed3d</code></a>
chore: version packages (rc) (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2868 ">#2868</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3dd35b6d0c4d7e5d2499ce44d85ecb0c0a34e1fd "><code>3dd35b6</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2862 ">#2862</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/7639085f4d8d998ea4f9cfc0de8440c77bc2f78d "><code>7639085</code></a>
feat(langgraph): add graph lifecycle callbacks (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2861 ">#2861</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/ec67d5d70dc26341e92a0962d9d2f4018c310b39 "><code>ec67d5d</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2852 ">#2852</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/e75f6a08e96f65d201a0bb501a97e00bcffe83a2 "><code>e75f6a0</code></a>
feat(langgraph): add responseSchema option to interrupt() (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2824 ">#2824</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/592fd0cab0fd9287fab1b7c7fcfd4abc44675700 "><code>592fd0c</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2832 ">#2832</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a3172e045b36b00244512260b041e472b915c39b "><code>a3172e0</code></a>
revert(langgraph): <code>tracePolicy</code> (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2834 ">#2834</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/a97e6f4eaf8683cd67002bc42cf8dddf5255e29d "><code>a97e6f4</code></a>
chore(deps): patch vulnerable browser and example dependencies (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2822 ">#2822</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6fb9a3fe43d0e4d600fbf413392343d7242ccb63 "><code>6fb9a3f</code></a>
chore(deps): bump vitest from 4.1.10 to 4.1.11 (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2818 ">#2818</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.18/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/releases ">@eslint/eslintrc's
releases</a>.</em></p>
<blockquote>
<h2>eslintrc: v3.3.7</h2>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md ">@eslint/eslintrc's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslintrc/commit/7943fa6dd55b236a539f658b88c763a4f9fbb38d "><code>7943fa6</code></a>
chore: release 3.3.7 🚀 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/240 ">#240</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f "><code>bb0d97a</code></a>
fix: update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/5b4abc9c74dd92b9eb782ca81d559a88906509e9 "><code>5b4abc9</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 "><code>f27e7c9</code></a>
fix: Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/b75e1d2425deebfd1ec7f952dda7d0c4f4d65d5c "><code>b75e1d2</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/302c13310e148268f990df3edbfd10dab44f2678 "><code>302c133</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/e62e7661b0d9063e42a37af5551bbcb1897e188d "><code>e62e766</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/cf27f9fd8f775d94500f2569a5bfb6a7de9cdb33 "><code>cf27f9f</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/c7f4cdf1ffa86e28b5b8bf09f9e8bc7fadbf87ff "><code>c7f4cdf</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/3319822ac925e018c47fcafa351b20ea0bf6eeff "><code>3319822</code></a>
docs: Update README sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>Vinccool96</li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] add
rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12730 ">#12730</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
imported values used in object shorthand properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12780 ">#12780</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] no false
positive on RHS of a nested logical expression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12728 ">#12728</a>)</li>
<li><strong>eslint-plugin:</strong> [member-ordering] don't report
fields that read fields declared before them (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12729 ">#12729</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9d82e4b1d9011da31d62d14387bb5a539853fafa "><code>9d82e4b</code></a>
chore: expand eslint-plugin rules test files glob (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12878 ">#12878</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f7482f636b89b8eab966b4191ce4a53a3f4b4d9c "><code>f7482f6</code></a>
fix(eslint-plugin): [no-misused-promises] handle multiple Promise
constituent...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/267304477e04538614fe72ad71e7e13082eb7a90 "><code>2673044</code></a>
docs(eslint-plugin): [prefer-promise-reject-errors] add option sections
and e...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f141a2ba63d539465eb4e4604f7d79f6f50ce14 "><code>8f141a2</code></a>
fix(eslint-plugin): [no-useless-default-assignment] convert the fixer to
a su...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/479cd85ff82b81dbec9989621681257ebc317a69 "><code>479cd85</code></a>
chore: enable assertion option <code>requireData</code> for all rule
tests (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12816 ">#12816</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f3c190c5b5cfa9edaba15fa3f944a76a7364b3ed "><code>f3c190c</code></a>
fix(eslint-plugin): [no-unnecessary-condition] handle union-keyed index
acces...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b1993dfd3c45b2c2d83058627499f1dfec5d6d2c "><code>b1993df</code></a>
fix(eslint-plugin): [unbound-method] treat
Intl.Collator.prototype.compare as...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/da394bc9c21afe97f456040da723d2c558f99658 "><code>da394bc</code></a>
fix(eslint-plugin): [no-unnecessary-parameter-property-assignment]
account fo...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4a742ff890b7cca8cbf79e78a9a3b345913094c6 "><code>4a742ff</code></a>
fix(eslint-plugin): [await-thenable] prevent autofix from breaking code
when ...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.69.0 (2026-08-31)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.69.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7ee76085c22e923c0036b8e0733a3ca7dfd82b60 "><code>7ee7608</code></a>
chore(release): publish 8.70.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9a6e546823e5d8f2dc015df2aa66c0230615e209 "><code>9a6e546</code></a>
chore(release): publish 8.69.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.9.1 to 10.11.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.11.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21271 ">#21271</a>)
(Pavel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/397b3b8134b8ce1a61cbf414d4c29c945ba25690 "><code>397b3b8</code></a>
feat: report unsafe labeled <code>continue</code> in
<code>no-unsafe-finally</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21316 ">#21316</a>)
(electrohyun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d3dd47f42e4cb5f9da27e3a2e741aa21e02ea1a4 "><code>d3dd47f</code></a>
feat: only exempt <code>new-cap</code> built-ins that reference the
global (<a
href="https://redirect.github.com/eslint/eslint/issues/21290 ">#21290</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b684bb1cd7e6be03ad1b7a951baead936d9c2166 "><code>b684bb1</code></a>
fix: make TimePass.parse optional in types and docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21313 ">#21313</a>)
(ntnyq)</li>
<li><a
href="https://github.com/eslint/eslint/commit/26d11bce3e0e21f223613d4bb4be3423839b229e "><code>26d11bc</code></a>
fix: don't report <code>__proto__</code> properties in
<code>object-shorthand</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21310 ">#21310</a>)
(xbinaryx)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)
(bytedoe)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6c789ff39bc5420e94e8dafeb328bf2b7e3d35ab "><code>6c789ff</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5997825635dc9c4e81434894607ef2e3887e0ea3 "><code>5997825</code></a>
docs: clarify preserve-caught-error known limitation (<a
href="https://redirect.github.com/eslint/eslint/issues/21294 ">#21294</a>)
(Akinyemi Toluwalase)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ac74e37322ebf122ada676f153dc55c81f3caab0 "><code>ac74e37</code></a>
chore: Add AGENTS.md with AI disclosure requirements (<a
href="https://redirect.github.com/eslint/eslint/issues/21221 ">#21221</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c8326608e710e670beaf982501aed80ea104919a "><code>c832660</code></a>
chore: Upgrade Stylelint to the latest version in docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21245 ">#21245</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f9f88fcccd965fdc162b89c4615dd4018e3cabdf "><code>f9f88fc</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21308 ">#21308</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fc81076a5b8145360654d81cbc130cf7d25dca77 "><code>fc81076</code></a>
ci: add more types integration tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20395 ">#20395</a>)
(Nitin Kumar)</li>
</ul>
<h2>v10.10.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/264b4346d1963701df0c398b4aeb2f6e8b2af93e "><code>264b434</code></a>
feat: add <code>d</code> and <code>v</code> flags to
<code>no-unexpected-multiline</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21305 ">#21305</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c6cc6c592f30901345d94ef75e0d42c1894fae6c "><code>c6cc6c5</code></a>
feat: check <code>Object.prototype</code> property names in
<code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21269 ">#21269</a>)
(crimsonjay0)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5661fa65fde9fd4c14f0b730e3cee6a42fc657c1 "><code>5661fa6</code></a>
feat: no-extra-bind false negatives with class fields and static blocks
(<a
href="https://redirect.github.com/eslint/eslint/issues/21260 ">#21260</a>)
(synthex-byte)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bb47dc6da2399a8f76c0c0c3273e6bc314c480e5 "><code>bb47dc6</code></a>
fix: update dependency file-entry-cache to v11 (<a
href="https://redirect.github.com/eslint/eslint/issues/20801 ">#20801</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/427ac0a014066c36aa57fa8fa9af20fd9fb591e1 "><code>427ac0a</code></a>
fix: use format strings in debug calls (<a
href="https://redirect.github.com/eslint/eslint/issues/21247 ">#21247</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9d8153223dbf47b9aecdc1474202aaee4845f146 "><code>9d81532</code></a>
fix: support <code>__proto__</code> in <code>/* exported */</code>
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21261 ">#21261</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/87e0a082438264ad90b87fd74165ab4fd90f63ef "><code>87e0a08</code></a>
fix: prefer-object-has-own autofix breaks when Object is shadowed (<a
href="https://redirect.github.com/eslint/eslint/issues/21282 ">#21282</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8e2cb142217f2efee1d10dcc02bfb75145ae775d "><code>8e2cb14</code></a>
fix: <code>new-cap</code> false positive for <code>UTC</code> calls with
<code>properties: false</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21275 ">#21275</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9f4a364ab0ade048dfce1f37792b1d461d866e55 "><code>9f4a364</code></a>
fix: Ignore static imports in no-unreachable (<a
href="https://redirect.github.com/eslint/eslint/issues/21276 ">#21276</a>)
(Taha Kotil)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2417cad57d7d1bc4cf3ecf0f0575cfb10ff2011c "><code>2417cad</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9cecb8a0a2348070abf72321965d41919c7cc626 "><code>9cecb8a</code></a>
docs: document <code>\c</code> control letter escapes in
no-control-regex (<a
href="https://redirect.github.com/eslint/eslint/issues/21286 ">#21286</a>)
(한국)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8724829f69f8ed80c876e3a5a017da199ce78739 "><code>8724829</code></a>
docs: update compat table links (<a
href="https://redirect.github.com/eslint/eslint/issues/21263 ">#21263</a>)
(fnx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5634542be580750ffb1a5766470f9e9c72719696 "><code>5634542</code></a>
docs: Clarify eqeqeq suggestion behavior (<a
href="https://redirect.github.com/eslint/eslint/issues/21256 ">#21256</a>)
(Müslüm Yılmaz)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b3d876b46083d67899eb1d9613118c1c583632a2 "><code>b3d876b</code></a>
chore: disable npm audit in ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21306 ">#21306</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1696682791661c13167eb905da2f38d1b8f4a3bf "><code>1696682</code></a>
ci: restore EMFILE test on Node.js 26 (<a
href="https://redirect.github.com/eslint/eslint/issues/21297 ">#21297</a>)
(Marry (Subin Yang))</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/3c0b7c6e1fe2dec778b97a996018126f22d437ae "><code>3c0b7c6</code></a>
10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/321f0a70dd908ed461b11142e17fbdc0c0f1f198 "><code>321f0a7</code></a>
Build: changelog update for 10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21 ">#21</a>...</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.9.1...v10.11.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `jest` from 30.5.0 to 30.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases ">jest's
releases</a>.</em></p>
<blockquote>
<h2>v30.5.2</h2>
<h2>Features</h2>
<ul>
<li><code>[@jest/transform]</code> Strip TypeScript types with Node when
no transformer claims a <code>.ts</code>, <code>.mts</code> or
<code>.cts</code> file (<a
href="https://redirect.github.com/jestjs/jest/pull/16421 ">#16421</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>[jest-core, jest-haste-map, jest-transform]</code> Keep
<code>require('../package.json')</code> external when bundling, so
<code>jest --version</code> and the transform and haste-map cache keys
report the released version instead of the previous one (<a
href="https://redirect.github.com/jestjs/jest/pull/16422 ">#16422</a>)</li>
<li><code>[jest-each]</code> Escape a table row's keys before building
the <code>$variable</code> interpolation <code>RegExp</code>, so a
column name such as <code>count(*)</code> no longer fails the whole
table with <code>Invalid regular expression</code>, and a <code>.</code>
or <code>|</code> in a column name is matched literally (<a
href="https://redirect.github.com/jestjs/jest/pull/16345 ">#16345</a>)</li>
<li><code>[@jest/source-map]</code> Resolve absolute Windows paths in a
source map's <code>sources</code> and <code>sourceRoot</code> again,
instead of appending them to the transformed file's directory (<a
href="https://redirect.github.com/jestjs/jest/pull/16439 ">#16439</a>)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/winklemad "><code>@winklemad</code></a>
made their first contribution in <a
href="https://redirect.github.com/jestjs/jest/pull/16345 ">jestjs/jest#16345</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2 ">https://github.com/jestjs/jest/compare/v30.5.1...v30.5.2 </a></p>
<h2>v30.5.1</h2>
<h2>Fixes</h2>
<ul>
<li><code>[jest-config]</code> Don't warn about global-only options in
the config that supplies the global config - the root config a project
resolves to, or the first entry of <code>--projects</code> when no root
config is passed (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-config, jest-types]</code> Stop accepting
<code>reporters</code>, <code>coverageReporters</code>,
<code>workerIdleMemoryLimit</code>, <code>cwd</code> and
<code>runnerOptions</code> in a project config - they were silently
ignored, and now warn like the other global-only options (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-config, jest-validate]</code> Warn about
<code>maxWorkers</code> and <code>coverageThreshold</code> in a project
config instead of dropping them without a word (<a
href="https://redirect.github.com/jestjs/jest/pull/16411 ">#16411</a>)</li>
<li><code>[jest-resolve]</code> Match <code>moduleNameMapper</code>
patterns against the specifier as written again (reverting <a
href="https://redirect.github.com/jestjs/jest/pull/16390 ">#16390</a>)
(<a
href="https://redirect.github.com/jestjs/jest/pull/16417 ">#16417</a>)</li>
<li><code>[jest-runtime]</code> Resolve package <code>imports</code>
specifiers like <code>#dep</code> under ESM again (<a
href="https://redirect.github.com/jestjs/jest/pull/16413 ">#16413</a>)</li>
</ul>
<h2>Chore & Maintenance</h2>
<ul>
<li><code>[jest-util]</code> Name the
<code>testEnvironmentOptions.globalsCleanup</code> option and link the
docs from the <code>JEST-01</code> deprecation warning, and document the
option's modes (<a
href="https://redirect.github.com/jestjs/jest/pull/16404 ">#16404</a>)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/HuzaifaChaudary "><code>@HuzaifaChaudary</code></a>
made their first contribution in <a
href="https://redirect.github.com/jestjs/jest/pull/16413 ">jestjs/jest#16413</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1 ">https://github.com/jestjs/jest/compare/v30.5.0...v30.5.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md ">jest's
changelog</a>.</em></p>
<blockquote>
<h2>30.5.2</h2>
<h3>Features</h3>
<ul>
<li><code>[@jest/transform]</code> Strip TypeScript types with Node when
no transformer claims a <code>.ts</code>, <code>.mts</code> or
<code>.cts...
_Description has been truncated_
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-10-17 18:27:10 -07:00
beb6fe2ffb
chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in /libs/cli/js-examples in the major group ( #9154 )
...
Bumps the major group in /libs/cli/js-examples with 1 update:
[dotenv](https://github.com/motdotla/dotenv ).
Updates `dotenv` from 17.4.2 to 18.0.4
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md ">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.3...v18.0.4 ">18.0.4</a>
(2026-09-25)</h2>
<h3>Changed</h3>
<ul>
<li><code>import dotenv/config</code> should default quiet: true (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1063 ">#1063</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.2...v18.0.3 ">18.0.3</a>
(2026-09-22)</h2>
<h3>Changed</h3>
<ul>
<li>Patch <code>DOTENV_QUIET</code> setting when inside .env file (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1059 ">#1059</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.1...v18.0.2 ">18.0.2</a>
(2026-09-21)</h2>
<h3>Changed</h3>
<ul>
<li>Patch additional edge cases for the fast parser (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1056 ">#1056</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.0...v18.0.1 ">18.0.1</a>
(2026-09-18)</h2>
<h3>Changed</h3>
<ul>
<li>Handle file urls in config logging (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1054 ">#1054</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.0 ">18.0.0</a>
(2026-09-17)</h2>
<h3>Added</h3>
<ul>
<li>NEW: Dotenv now has a CLI. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1022 ">#1022</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<ul>
<li>NEW: Dotenv now has a fast parser thanks to <a
href="https://github.com/homanp "><code>@homanp</code></a> of <a
href="https://superagent.sh ">superagent.sh</a>. Pass <code>config({
fast: true })</code>, flag <code>--fast</code>, or set
<code>DOTENV_FAST=true</code> to opt-in to ~2x faster character-scanner
parser. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1010 ">#1010</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<p><a href="https://dotenvx.com/blog/2026/09/28/dotenv-fast.html ">faster
than Node native parseEnv!</a></p>
<h3>Changed</h3>
<ul>
<li>Injecting message sent to stderr rather than stdout and tips removed
(<a
href="https://redirect.github.com/motdotla/dotenv/pull/1037 ">#1037</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/86804c0507aff98d3a82204759729af3bc2ce1a9 "><code>86804c0</code></a>
18.0.4</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/2403db57c3f8b01123d69a8b441a5f8b828fab3c "><code>2403db5</code></a>
changelog</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/75b775eda45af3085fb7a7de6ae2613eb646807e "><code>75b775e</code></a>
npm audit</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/7e1750ce8034b3c9485f1e1722587a40890449e1 "><code>7e1750c</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1064 ">#1064</a>
from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/a6ade63b6fa94a78fdc68f815c4e88cfe8781774 "><code>a6ade63</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1063 ">#1063</a>
from motdotla/import</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/288b0d7cd85d8deba3f91a995abd033786626a8d "><code>288b0d7</code></a>
patch test</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/00da9125dd7633a121d169a3a55b62a686b64ef8 "><code>00da912</code></a>
Bump ip-address from 10.2.0 to 10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/e6b58161d2f2b1448c735b1f6555bde7a20443b7 "><code>e6b5816</code></a>
import 'dotenv/config' should still be defaulting to quiet</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/3646ac5e5d000f5f68fe83db52399010f9cb781f "><code>3646ac5</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1061 ">#1061</a>
from motdotla/fast</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/83fc961f92f6c330833da4a5f5dc7093d539501e "><code>83fc961</code></a>
report dotenv vs native vs dotenv.fast</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-18 00:49:00 +00:00
0eb194fe60
chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 6 updates ( #9150 )
...
Bumps the minor-and-patch group in /libs/prebuilt with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.1`
| `1.6.5` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [syrupy](https://github.com/syrupy-project/syrupy ) | `6.0.0` | `6.1.1`
|
| [psycopg-binary](https://github.com/psycopg/psycopg ) | `3.3.4` |
`3.3.6` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
Updates `langchain-core` from 1.6.1 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.5</h2>
<p>Changes since langchain-core==1.6.4</p>
<p>release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</p>
<h2>langchain-core==1.6.4</h2>
<p>Changes since langchain-core==1.6.3</p>
<p>release(core): 1.6.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40718 ">#40718</a>)
chore(core): deprecate chat message history (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40711 ">#40711</a>)
chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40634 ">#40634</a>)
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40574 ">#40574</a>)</p>
<h2>langchain-core==1.6.3</h2>
<p>Changes since langchain-core==1.6.2</p>
<p>release(core): 1.6.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40407 ">#40407</a>)
feat(core): Allow model name and provider tracing metadata override
based on gateway response (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40406 ">#40406</a>)
test(core): cover the deprecated <code>.text()</code> access path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40243 ">#40243</a>)
docs(core): remove stale Args/Raises entries from
FileCallbackHandler._write and ChatGeneration.set_text (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40211 ">#40211</a>)</p>
<h2>langchain-core==1.6.2</h2>
<p>Changes since langchain-core==1.6.1</p>
<p>release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40209 ">#40209</a>)
feat(openai): support async tools (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40208 ">#40208</a>)
chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40150 ">#40150</a>)
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40113 ">#40113</a>)
fix(core): avoid mutation in google-genai standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40023 ">#40023</a>)
fix(core): avoid mutation in bedrock converse standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40022 ">#40022</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0 "><code>c5ab14d</code></a>
release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f "><code>5704d9d</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40804 ">#40804</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea "><code>7622d3d</code></a>
release(openai): 1.6.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40800 ">#40800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e "><code>2dd956b</code></a>
docs(infra): fix AGENTS.md root setup guidance and package doc accuracy
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40794 ">#40794</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621 "><code>49f4b40</code></a>
fix(openai): raise on error events in stream path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40791 ">#40791</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426 "><code>19cadaa</code></a>
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2 "><code>798441e</code></a>
chore(anthropic): fix integration test cassette (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40790 ">#40790</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1 "><code>a476942</code></a>
release(openai): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40787 ">#40787</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291 "><code>46c6bdf</code></a>
release(anthropic): 1.7.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40786 ">#40786</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8 "><code>290daba</code></a>
fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40785 ">#40785</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 6.0.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.1</h2>
<blockquote>
<p><strong>Note:</strong> 6.1.0 was skipped due to a CI issue. Use
<strong>6.1.1</strong>.</p>
</blockquote>
<h3>Experimental <code>--snapshot-file-lock</code> for pytest-xdist</h3>
<p><code>--snapshot-update</code> under pytest-xdist can race when
multiple workers rewrite the same multi-entry amber (<code>.ambr</code>)
file, silently dropping snapshots (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1237 ">#1237</a>).</p>
<p>This release adds an <strong>experimental</strong> opt-in:</p>
<ul>
<li><code>--snapshot-file-lock</code> — exclusive file lock + atomic
replace around amber writes</li>
<li><code>--snapshot-file-lock-timeout</code> — max wait for the lock
(default <strong>60s</strong>)</li>
</ul>
<p>Same-machine workers only; not reliable across remote workers / NFS.
See <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">#1239</a>.</p>
<blockquote>
<p><strong>Callout for pytest-xdist users:</strong> please try
<code>--snapshot-file-lock</code> with <code>--snapshot-update</code>
and <a href="https://github.com/syrupy-project/syrupy/issues ">open an
issue</a> if you hit problems. Locking is expected to become the default
in a future minor release.</p>
</blockquote>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.1 ">v6.1.1</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.0 ">v6.1.0</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2d251e73f1ebe47fe83ed71d835d3ae8580e8313 "><code>2d251e7</code></a>
chore(release): 6.1.1 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/9b64ec05752586c45d1097e9d25f9ee1d4e93219 "><code>9b64ec0</code></a>
chore(release): 6.1.0 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/5b4256eac8720075f25b0fa8491f75948001b983 "><code>5b4256e</code></a>
fix: opt-in file lock for concurrent amber writes under xdist (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1239 ">#1239</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/d4cb1513b5d2b1b18c3b407150db22d2d8604ddd "><code>d4cb151</code></a>
chore(deps): update dependency hypothesis to v6.168.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1238 ">#1238</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/16c4cb5b8785d89e49b8076a99f58d810e02fcce "><code>16c4cb5</code></a>
test: add coverage for read_snapshot_data_from_location returning None
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1236 ">#1236</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2e1d3ba0d39a1d87735213a32de9dd9cdb929690 "><code>2e1d3ba</code></a>
chore(deps): update dependency ruff to v0.16.6 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1235 ">#1235</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/fcc929d4deb2302f2d37e6511015ef43a0841bc2 "><code>fcc929d</code></a>
chore(deps): update actions/deploy-pages action to v5.0.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1234 ">#1234</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4f1bad75777ecc9d916a648dd3669b2844d08f7d "><code>4f1bad7</code></a>
chore(deps): update dependency hypothesis to v6.167.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1232 ">#1232</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/24eda28579f5761cbc64713ffcee41cc73602010 "><code>24eda28</code></a>
chore(deps): update dependency hypothesis to v6.167.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1231 ">#1231</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/0d7e46f9431e07810da4ef90dbe861b85fbc8469 "><code>0d7e46f</code></a>
chore(deps): update dependency hypothesis to v6.166.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1230 ">#1230</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `psycopg-binary` from 3.3.4 to 3.3.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst ">psycopg-binary's
changelog</a>.</em></p>
<blockquote>
<p>.. currentmodule:: psycopg</p>
<p>.. index::
single: Release notes
single: News</p>
<h1><code>psycopg</code> release notes</h1>
<h2>Future releases</h2>
<p>Psycopg 3.3.7 (unreleased)
^^^^^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix segfault fetching arrays of strings or timestamps after closing
the
connection
(🎫 <code>[#1428 ](https://github.com/psycopg/psycopg/issues/1428 )</code>).</li>
</ul>
<h2>Current release</h2>
<p>Psycopg 3.3.6
^^^^^^^^^^^^^</p>
<ul>
<li>Add support for Python 3.15
(🎫 <code>[#1245 ](https://github.com/psycopg/psycopg/issues/1245 )</code>).</li>
<li>Improve performance of async queries by reducing the overhead of the
<code>!wait_async()</code> function
(🎫 <code>[#1331 ](https://github.com/psycopg/psycopg/issues/1331 )</code>).</li>
<li>Don't wait forever for a query to terminate after interrupting it,
for
instance if the server is unresponsive. The fix requires libpq 17 or
newer
(🎫 <code>[#1371 ](https://github.com/psycopg/psycopg/issues/1371 )</code>).</li>
<li>Cancel a running query upon receiving <code>!SystemExit</code>
(🎫 <code>[#1384 ](https://github.com/psycopg/psycopg/issues/1384 )</code>).</li>
<li>Report <code>!None</code> instead of <code>65535</code> as the
<code>Column.precision</code> of an
:sql:<code>interval</code> column declared with a fields restriction and
no explicit
precision, such as e.g. :sql:<code>interval day to second</code>
(🎫 <code>[#1397 ](https://github.com/psycopg/psycopg/issues/1397 )</code>).</li>
<li>Fix dumping of nested subclasses of lists as arrays
(🎫 <code>[#1398 ](https://github.com/psycopg/psycopg/issues/1398 )</code>).</li>
<li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code>
(🎫 <code>[#1408 ](https://github.com/psycopg/psycopg/issues/1408 )</code>).</li>
<li>Better guards dumping large Python <code>!int</code> to binary
numeric
(🎫 <code>[#1414 ](https://github.com/psycopg/psycopg/issues/1414 )</code>).</li>
</ul>
<p>Psycopg 3.3.5
^^^^^^^^^^^^^</p>
<ul>
<li>Discard prepared statements upon :sql:<code>ALTER *</code> or
<code>DISCARD *</code>
(🎫 <code>[#1307 ](https://github.com/psycopg/psycopg/issues/1307 )</code>).</li>
<li>Fix <code>!ProgrammingError</code> when dumping
non-<code>!None</code> values with
no <code>!NoneType</code> dumper registered in python implementation
(🎫 <code>[#1325 ](https://github.com/psycopg/psycopg/issues/1325 )</code>).</li>
<li>Fix <code>!wait_selector</code> wait function to not raise
<code>!KeyError</code>
(🎫 <code>[#1327 ](https://github.com/psycopg/psycopg/issues/1327 )</code>).</li>
<li>Fix <code>!DataError</code> messages leaking the literal
<code>{...}</code> placeholder instead</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psycopg/psycopg/commit/a67654d1e7afbf9b3a619557838f62de1c790e7c "><code>a67654d</code></a>
chore: bump psycopg package version to 3.3.6</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/443814b3b111ac678a39fd523c1a826266fb69b5 "><code>443814b</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1416 ">#1416</a>
from dvarrazzo/wait-async-perf</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/42966e9ebbda3b9c69b15c5588543c15f2aae5dd "><code>42966e9</code></a>
test: add helpful comments to some tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/5e8797f0c8003d8cd12a1e5c13f05fbb94c1c1d2 "><code>5e8797f</code></a>
test: add reasonable connect_timeout to most tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/c81ba62442dfbd69e207d6914e6ae2aa27e56886 "><code>c81ba62</code></a>
perf: reduce the overhead of wait_async()</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/d2bbfe4e2b1e36a20e72a18097f35a3db27296e3 "><code>d2bbfe4</code></a>
refactor: use get_running_loop() in the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b1484a550e01c88fda077099678f0abb9217ecb "><code>2b1484a</code></a>
test: add a script to measure the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/573cf4aa70d8fdefc9d5f3eb69d5419cd6d3cd51 "><code>573cf4a</code></a>
test: fix incorrect wait timing test</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b68990874175b8d97269218d4963b2d5c8656f3 "><code>2b68990</code></a>
refactor: drop leftovers of waiting with inf interval in
wait_conn_async</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/60765dd8fc7d8df03cd75efcff485bfb3c83a0ed "><code>60765dd</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1414 ">#1414</a>
from dvarrazzo/fix-decimal-overflow</li>
<li>Additional commits viewable in <a
href="https://github.com/psycopg/psycopg/compare/3.3.4...3.3.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-17 16:17:52 +00:00
Elior Nataf Lackritz
41c9c22fdc
release(langgraph): 1.2.16 ( #9334 )
...
Bumps langgraph from 1.2.15 to 1.2.16.
Includes:
- Keep a DeltaChannel's value when its field changes to a plain reducer
(#9302 )
- Save a resumed exit run's pending writes once (#9314 )
- Stop a subgraph from rerunning its finished tasks on resume (#9315 )
- Apply a resumed `Command`'s update once (#9322 )
- Let other tasks finish when a resume value is invalid (#9265 )
2026-10-16 18:02:08 -04:00
Elior Nataf Lackritz
51018652a6
release(sdk-py): 0.4.8 ( #9335 )
...
Bumps the Python SDK version from 0.4.7 to 0.4.8. Thread streams now
report why they ended: a server's error frame becomes the error
`thread.output` raises, the sync client no longer blocks forever when
the server closes the stream, and a stream the server rejects with a 4xx
ends at once instead of being retried (#9317 ).
2026-10-16 18:01:53 -04:00
Elior Nataf Lackritz
9e6fc45c6f
fix(sdk-py): surface thread stream errors and stop retrying a rejected stream ( #9317 )
...
## Summary
Thread streams in `langgraph_sdk` now report why they ended. An `id:
null` error frame becomes the error `thread.output` raises, the sync
client no longer blocks forever when the server closes the stream, and a
stream the server rejects with a 4xx ends at once instead of being
retried.
## Problem
- A server sends `{"type": "error", "id": null, ...}` just before it
closes a thread stream whose read failed. The SDK dropped the frame, so
`thread.output` raised a generic "lifecycle stream ended before terminal
event" (async) or blocked forever (sync: the lifecycle watcher returned
without settling the run).
- A 403 or 404 on the stream request was retried like a network error,
then reported as `RuntimeError("Lifecycle transport failed: ...")` with
no status. A server that rejects a WebSocket after accepting it closes
with 4000 plus the HTTP status (4403, 4404, 4422), since a browser can't
read a refused upgrade's status. The shared stream counted each such
reconnect as a success and reconnected forever.
## Fix
- The lifecycle watcher fails the run with the frame's error on a clean
close (both clients). The shared stream logs the frame instead of
dropping it: projections still end when the stream closes, as before,
and `thread.output` carries the error.
- A 4xx other than 408 and 429, as a status or as a 4000+status close
code, ends the stream without retries. `thread.output` now raises that
`httpx.HTTPStatusError` or `websockets.exceptions.ConnectionClosedError`
instead of the generic `RuntimeError`.
- For a minted `thread_id`, the lifecycle watcher starts after
`run.start` creates the thread. Without this, the 4xx stop would turn a
stream opened under custom auth for a not-yet-created thread from
retried into failed. The sync client starts it under a lock, since
`run.start` can be called from several threads.
- Drops the first of two `SyncStreamController._reconnect_shared_stream`
definitions. It was shadowed by the second and never ran.
Not in this PR: over WebSocket the server closes with 1011 after an
error frame, which is still retried, while over SSE the close is clean
and fails the stream. Reconnecting after a clean close, as
`langchain-ai/langgraphjs#2812` does for the JS SDK, is a separate
change.
## Test plan
- [x] The 10 new behavior tests (async and sync: error frame, clean
close, 404, 4404 close, reconnect on 404, minted `thread_id`) fail on
`main` and pass here; a race test checks that two concurrent `run.start`
calls start one watcher.
- [x] `make test` in `libs/sdk-py`: 541 passed. `make lint` clean,
`check_sdk_methods.py` passes.
- [x] `RemoteGraph` v3 tests in `libs/langgraph`
(`test_remote_graph_v3.py`,
`test_stream_events_v3_kwarg_forwarding.py`): 94 passed against this
SDK.
- [x] Against a local server with custom auth: a thread the caller can't
read fails at once with 404 (SSE) or 4404 (WebSocket), and a new thread
works with a 1 s pause before `run.start`, which fails on `main`.
2026-10-16 15:29:34 -04:00
Baihao Wang
b0cabd93d0
fix(langgraph): let other tasks finish when a resume value is invalid ( #9265 )
...
Found while testing per-call human-in-the-loop
(langchain-ai/langchain#41062). The code depends only on #9232 , which is
already on `main`.
When one answer in a multi-answer resume fails `response_schema`
validation, the runner cancelled the other tasks in the step, so in
async runs a task cut off after its side effect kept its saved answer
and ran again on the next resume. Invalid resume values (already tagged
by `is_invalid_resume` from #9232 ) no longer stop the other tasks: the
error is raised once they finish, so their results are saved.
Hit by per-call human-in-the-loop: approving one tool call while giving
another an invalid edit, in one resume, sent the approved call's email
twice once the second answer was fixed.
## How to verify
- `test_invalid_resume_lets_other_answered_tasks_finish` fails on `main`
(the approved task is still pending after its side effect) and passes
with this change. Like the other async interrupt tests, it is skipped
before Python 3.11, where async nodes can't call `interrupt()`.
- The per-call HITL reproduction against this branch: the approved async
tool runs once (twice on `main` whenever it awaits after its side
effect).
- `make lint` passes. With `NO_DOCKER=true`, the full `libs/langgraph`
suite has the same failures as `main` locally (`test_prebuilt_tool_chat`
and `test_stream_mode_messages_command`, sync and async), and nothing
new.
2026-10-16 11:33:53 -07:00
raghavverma-langchain
4ac46ba186
release(cli): 0.4.36 ( #9330 )
...
## Summary
<!-- Write the summary yourself -->
## Notes for reviewers
- Includes [push through the active Docker
context](https://github.com/langchain-ai/langgraph/pull/9321 ) and
[accept serverless and dedicated deployment
aliases](https://github.com/langchain-ai/langgraph/pull/9325 ), the two
CLI changes merged since 0.4.35.
- Merging doesn't publish by itself: after it merges, run the `release`
workflow with `working-directory: libs/cli`, as was done for 0.4.35.
## Test Plan
- [x] Only `__version__` in `libs/cli/langgraph_cli/__init__.py` changes
(0.4.35 → 0.4.36), like the 0.4.35 release PR
- [ ] After merge, the `release` workflow for `libs/cli` succeeds and
PyPI shows `langgraph-cli` 0.4.36
- [ ] `uvx --from langgraph-cli==0.4.36 langgraph deploy` pushes on
Docker Desktop without `DOCKER_HOST` set
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-16 12:29:42 -04:00
Elior Nataf Lackritz
e14f4277dc
fix(langgraph): apply a resumed Command's update once ( #9322 )
...
`Command(resume=..., update=...)` applied its update twice once the
resumed node called `interrupt()` again, with sync or async durability
(`invoke`'s default). A node that asks three times, resumed with
`Command(resume=str(i), update={"log": [f"u{i}"]})`, ends with `["u1",
"u1", "u2", "u3", "a:123"]`.
## Cause
The null task's writes are saved as one list, and savers key a regular
write by its position in that list. The Command's resume came first, so
its update was stored at index 1. The next Command saved the null task's
earlier writes again without the resume, which put the update at index
0, so it was stored twice and every later resume applied both copies.
`durability="exit"` saves after the resume is consumed, so it wasn't
affected.
## Fix
The null task's special writes (a resume) now go after its regular ones,
so each regular write keeps its index as the list grows.
`test_resume_with_update_applies_the_update_once` fails on `main` for
sync and async durability.
Found by @hntrl, and flagged by @soarez on #9314 .
2026-10-16 12:07:59 -04:00
hari-dhanushkodi
4e2dfe4a24
fix(cli): accept serverless and dedicated deployment aliases ( #9325 )
2026-10-16 08:02:43 -04:00
raghavverma-langchain
e77a5cb08c
fix(cli): push through the active Docker context in langgraph deploy ( #9321 )
...
## Summary
<!-- Write the summary yourself -->
## Notes for reviewers
- Known gap: `--host` carries only the context's endpoint, not its TLS
settings, so a remote context that uses client certificates still can't
push. That case was broken before this change too, and it's rare for
local builds.
- A context with no Docker endpoint (Docker prints `<no value>`) or a
missing `docker` binary falls back to today's behavior.
## Test Plan
- [x] `make lint` and `make test` pass in `libs/cli` (556 tests)
- [x] New tests: `login` and `push` get the active context's endpoint as
`--host`; with `DOCKER_HOST` set there's no lookup and no `--host`; when
the context lookup fails, or the context has no Docker endpoint, there's
no `--host` and the deploy still succeeds. The first fails without the
change.
- [x] On a Mac running Docker Desktop with no `/var/run/docker.sock`:
`docker --config <temp dir> version` fails with `failed to connect to
the docker API at unix:///var/run/docker.sock`, and adding `--host
<active context endpoint>` reaches the daemon
- [x] Reproduced end to end on LangSmith AWS: `langgraph deploy`
(0.4.35) failed at the push with that error, then passed with
`DOCKER_HOST` set to the context's endpoint, which this change does
automatically
- [ ] After release, `langgraph deploy` pushes on Docker Desktop without
`DOCKER_HOST` set
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-15 16:14:01 -04:00
Elior Nataf Lackritz and Connor Imes
b0482d0627
fix(langgraph): stop a subgraph from rerunning its finished tasks on resume ( #9315 )
...
Fixes #9106
When a subgraph pauses in several parallel interrupts and they're answered one at a time, each resume ran the nodes that were already answered again. Their saved answers carried them straight through `interrupt()`, so whatever they do after it (an API write, say) ran once more per later answer, while the final state still looked right. A `@task` that finished before an interrupt in a nested graph reran the same way, which is the rerun reported in #6792 .
## Cause
Every task config sets `checkpoint_id` to None, and `PregelLoop` treats a config with that key as a replay, so a nested graph replayed on every resume. A replaying loop doesn't hand saved writes back to the tasks that made them, so finished tasks ran again.
## Fix
`PregelLoop` now notes whether the run points it at a checkpoint (a truthy `checkpoint_id`, its own `checkpoint_map` entry, or a parent that is replaying), the test `__enter__` already uses to pick the checkpoint to load. `_first` then decides once whether finished tasks rerun: only on time travel, or on a resume at a checkpoint the thread has moved past. A plain resume of a subgraph is neither, so it hands finished tasks their writes back the way a top-level resume does.
The same rule fixes the top level, which @hntrl pointed out: a resume sent with the head's `checkpoint_id`, as Studio sends it, or with `checkpoint_id: None` reran finished siblings too. A resume at an older checkpoint still reruns them, as the checkpoint migration tests expect. Telling the two apart costs one more checkpoint read for a run sent with a `checkpoint_id`. `test_addressed_resume_keeps_a_rerun_tasks_write_to_a_new_channel` relied on a resume at the head rerunning a task, so it now resumes a checkpoint the thread has moved past.
Most subgraph time travel forks first, which gives tasks new ids, so saved writes can't match them anyway. `test_subgraph_replay_reasks_answered_parallel_interrupt` replays an update checkpoint, which runs in place: it passes on `main` and fails if subgraphs never replay.
The counters added to `test_parallel_interrupts_double` and the three new tests in `test_interrupt_state.py` fail on `main`.
## Not in this PR
- With `durability="exit"` and three or more parallel interrupts, a subgraph now hits a bug top-level graphs already have: a finished task's output is applied twice. #9314 fixes it.
- #6792 also reports the interrupt of a `@task` inside a nested `@entrypoint` coming back twice. That's a separate bug.
Thanks @connorimes for the report, the root cause and the fix, which this applies as proposed. The same change was opened as #9113 by @AnvitDevadiga, and @morehardy found the root cause for #6792 in #6793 .
JS: langchain-ai/langgraphjs#3028
Co-authored-by: Connor Imes <5701850+connorimes@users.noreply.github.com >
2026-10-15 15:51:21 -04:00
Elior Nataf Lackritz
889a5ff16f
fix(langgraph): save a resumed exit run's pending writes once ( #9314 )
...
With `durability="exit"`, resuming three or more parallel interrupts one
at a time applied the earlier answers twice. Nodes `a`, `b` and `c` each
return `{"log": [f"{name}:{interrupt(name)}"]}`, and the run ends with
`{"log": ["a:yes", "a:yes", "b:yes", "c:yes"]}`.
## Cause
An exit-mode run saves its pending writes when it ends, and that save
took all of them, including the ones loaded with the checkpoint. Savers
key a task's writes by their position in the list they're given. A task
that finished in an earlier run comes back with its old interrupt next
to its output, so saving its list again put the output under a new
index, and the next load applied both copies.
## Fix
The save at exit keeps only the writes of tasks that wrote during this
run. The rest are already stored on the checkpoint, which is what sync
and async durability do.
`test_finished_task_output_applies_once` fails on `main` in exit mode
for every saver and passes for sync and async.
The #9106 fix needs this too: once a subgraph stops rerunning its
finished tasks, it hits this bug in exit mode.
JS: langchain-ai/langgraphjs#3027
2026-10-15 15:26:01 -04:00
Baihao Wang
5eb60aef6f
release(prebuilt): 1.1.1 ( #9316 )
...
Bumps langgraph-prebuilt from 1.1.0 to 1.1.1.
Includes:
- Stop `ToolNode` from swallowing a resume value that fails an
interrupt's `response_schema` (#9232 ). This needs langgraph 1.2.15 or
later, which marks those errors; with an older langgraph, `ToolNode`
keeps today's behavior.
- Keep tool results out of v3 messages (#7838 )
Managed Deep Agents (langchain-ai/managed-deepagents-sdk#710 ) will raise
its `langgraph-prebuilt` minimum to this release, so an invalid answer
to an interrupt raised inside a tool, such as a subagent, fails the
resume instead of reaching the model.
After merge, run the Release workflow with
`working-directory=libs/prebuilt`.
---
This PR was written with help from an AI coding agent (Claude Code); a
human reviewed and directed the changes.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
2026-10-14 18:31:09 -07:00
Elior Nataf Lackritz
d4149cc1f5
release(checkpoint-postgres): 3.2.0 ( #9313 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointpostgres==3.1.3`:
- #9290 - add `prune` / `aprune` to `PostgresSaver` and
`AsyncPostgresSaver`
Minor version for the new public API. It needs nothing beyond the
`langgraph-checkpoint>=4.3.0` floor 3.1.3 already set.
2026-10-14 15:41:43 -04:00
Elior Nataf Lackritz
36bf3887f0
feat(checkpoint-postgres): add prune to PostgresSaver and AsyncPostgresSaver ( #9290 )
...
Closes #8531 .
`PostgresSaver` and `AsyncPostgresSaver` inherited `prune` / `aprune`
from the base class, which raises `NotImplementedError`, so long-lived
threads had no supported way to drop old checkpoints. This adds both
strategies. Thanks to @wangjiawei-vegetable for proposing this scope in
#8531 and #9247 .
- **`delete`** removes every checkpoint, write and blob of the threads,
in one transaction.
- **`keep_latest`** keeps the latest checkpoint of each namespace (the
one `get_tuple` loads), with its pending writes and the blobs it
references, and deletes the rest, including blobs only the deleted
checkpoints used. A kept checkpoint whose parent is deleted is left with
no parent. A subgraph call's namespace goes with the root checkpoint the
call started from; a `checkpointer=True` subgraph keeps its latest
checkpoint, since its state outlives each call.
- **Each thread is pruned on one snapshot.** Its transaction runs at
`REPEATABLE READ` and deletes everything that snapshot sees except the
kept checkpoints, so a run appending to the thread at the same time is
safe, whatever its checkpoint IDs.
- **`keep_latest` refuses threads that use a `DeltaChannel`**
(`NotImplementedError` naming them, nothing pruned). A `DeltaChannel`
rebuilds its latest value from older checkpoints, so deleting them would
empty it. The saver can't see channel types, so it detects one by what
only a `DeltaChannel` leaves: `counters_since_delta_snapshot` in
metadata, a snapshot (an inline `true` with a blob behind it), or
`delta_writes_versioned`, which LangGraph.js sets on threads its
`DeltaChannel` graphs start. The check runs for the whole batch first
and again in each thread's transaction, so a thread that starts using a
`DeltaChannel` mid-batch is refused at its turn.
Unlike the `prune` in #6883 , `keep_latest` here deletes the blobs older
checkpoints no longer share with the kept ones (most of the storage on a
long thread), and guards `DeltaChannel` threads.
Measured locally, with or without planner statistics: a 6,000-checkpoint
thread prunes in 100 to 200 ms, and one with 1,500 finished subgraph
calls in about 110 ms.
## Known limitations
- Two prunes of the same thread at once can fail one of them with a
serialization failure or a deadlock; retrying is safe.
- Forking or replaying from a checkpoint while it's being pruned is not
safe.
- Threads written by older releases can escape the `DeltaChannel` check:
before #9142 (Python 1.2.13) and langchain-ai/langgraphjs#2973 (JS
1.5.0), some `update_state` paths saved checkpoints with neither
counters nor a snapshot.
- Postgres reuses the freed space but doesn't shrink the table files;
that takes `VACUUM FULL` or `pg_repack`.
- `DeltaChannel`-aware pruning (keeping ancestors back to the last
snapshot) is a follow-up.
## Test plan
- [x] `libs/checkpoint-postgres/tests/test_prune.py`: 71 tests over the
sync and async savers (single connection, pool, pipeline), including the
conformance `prune` capability. Passes on Postgres 15 and 16.
- [x] `libs/langgraph/tests/test_prune_postgres.py`: 39 graph tests. A
pruned thread loads the same state and keeps running like an unpruned
twin (sync, async and exit durability, interrupts, a failed parallel
step, interrupted and `checkpointer=True` subgraphs), plus deterministic
races: a turn saved mid-prune, and threads switching to a `DeltaChannel`
before and after their own check.
- [x] Each guard (the snapshot, the writes and blob scopes, the subgraph
call rules, the parent reset, the `DeltaChannel` checks, the
single-string check, the pre-v4 pending sends, the pipeline sync) broken
one at a time: every break fails at least one test.
- [x] A thread pruned in a loop while it runs, in each durability mode,
ends identical to its twin; threads written by LangGraph.js 1.5.0 and
pruned from Python behave like their twins.
2026-10-14 15:09:51 -04:00
gethin-langchain
e5b422455d
release(cli): 0.4.35 ( #9310 )
...
Bumping the CLI to 0.4.35 to cut a release including #9305
(--image-pull-secret).
2026-10-14 17:07:39 +01:00
gethin-langchain
6cd26d0e21
feat(cli): add --image-pull-secret for deploying through a private registry ( #9305 )
...
## Summary
Deployments created with `--push-to` or `--image-uri` had no way to tell
the control plane which Kubernetes secret to use for pulling the image,
so deploying through a private registry that requires authentication
(e.g. an ECR repository gated by an imagePullSecret) wasn't possible at
all.
The control plane's `resource_spec` already supports
`image_pull_secrets` (a list of references to
`kubernetes.io/dockerconfigjson` secrets); the CLI just never exposed a
way to set it. This adds a repeatable `--image-pull-secret <name>` flag
that populates it.
```bash
langgraph deploy --push-to 123456789.dkr.ecr.us-east-1.amazonaws.com/agents/my-agent \
--image-pull-secret regcred
```
Validation follows the same pattern already used for
`--listener-id`/`--k8s-namespace`: only valid when creating a deployment
with `--push-to` or `--image-uri`, and rejected on an existing
`--deployment-id` (the secret list is fixed at creation, same as
listener placement).
## Test plan
- [x] Added unit tests for the new `_resource_spec` helper (empty list
keeps today's default, secrets become the expected `{"name": ...}` list)
- [x] Added CLI-level tests: secret(s) land in
`source_config.resource_spec.image_pull_secrets` on create (for both
`--push-to` and `--image-uri`), rejected without
`--push-to`/`--image-uri`, rejected on an existing `--deployment-id`
- [x] `make format && make lint` clean
- [x] `make test` passes, 539 passed (9 new), no regressions
2026-10-14 16:11:04 +01:00
raghavverma-langchain
53cf85bece
feat(cli): log in with the registry username the control plane returns ( #9301 )
...
## Summary
<!-- Write the summary yourself -->
## Test Plan
- [x] `make format`, `make lint` and `make test` pass in `libs/cli` (534
tests)
- [x] New tests cover the opt-in request body, logging in with the
returned `username`, and pushing to exactly `repository_url`; they fail
without the change
- [x] Backward compatible: without `username` or `repository_url` in the
response, the CLI logs in as `oauth2accesstoken` and pushes to
`registry_url/<name>` as before, and control planes that don't read the
request body ignore it
- [ ] With the LangSmith AWS change (langchain-ai/langchainplus#49248 )
live: `langgraph deploy` builds locally, pushes to the deployment's ECR
repository, and deploys
## Demo
<!-- Drag a screen recording or screenshot here -->
2026-10-14 10:31:24 -04:00
Saad Farooq
69d98cc0d9
fix(cli): preserve failed deployment build logs ( #9308 )
2026-10-14 09:05:38 -04:00
dependabot[bot]
ccb851effb
chore(deps): bump handlebars from 4.7.9 to 4.7.10 in /libs/cli/js-examples ( #9286 )
...
Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js )
from 4.7.9 to 4.7.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/releases ">handlebars's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.10</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code><!--</code> and <code><script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md ">handlebars's
changelog</a>.</em></p>
<blockquote>
<h2>v4.7.10 - October 5th, 2026</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code><!--</code> and <code><script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e "><code>45ce152</code></a>
v4.7.10</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8 "><code>e47b236</code></a>
Update release notes</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0 "><code>f37c599</code></a>
Sanitize the source map URL when minifying</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca "><code>812c226</code></a>
Iterate lazily in #each and strip whitespace in linear time</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 "><code>609d1b1</code></a>
Escape <code><!--</code> and <code><script</code> in precompiled
output</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa "><code>ceec388</code></a>
Don't trust special properties on context data</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98 "><code>c28ee7a</code></a>
Only compile partials that are template strings</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1 "><code>7d501a5</code></a>
Only dispatch known node types in the Compiler and Visitor</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 "><code>703fdcc</code></a>
Validate AST values in the compiler instead of the parser</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d "><code>0fcf25c</code></a>
Clarify that --root does not restrict filesystem access</li>
<li>Additional commits viewable in <a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-14 16:39:24 +09:00
Elior Nataf Lackritz
a6731f4367
fix(langgraph): keep a DeltaChannel's value when its field changes to a plain reducer ( #9302 )
...
Changing a field from a `DeltaChannel` to a plain reducer, for example
to `Annotated[list, add_messages]`, made threads written under the
`DeltaChannel` read that field as empty. The next run saved its writes
over the empty value, so continuing an old thread replaced its history.
The writes were still stored: the read only rebuilt fields whose current
annotation is a `DeltaChannel`.
- A `BinaryOperatorAggregate` stores its value at every version, so one
with a version and nothing stored was written as a `DeltaChannel`. It's
now rebuilt from the same history walk, one `update` per write, since a
single call would reject a second `Overwrite` and drop the writes after
one.
- `BinaryOperatorAggregate.from_checkpoint` unwraps a stored
`_DeltaSnapshot`.
- The next run saves the full value, so later reads are plain reads, and
switching back to a `DeltaChannel` keeps everything.
Threads written under a plain reducer never walk. A rebuilt read costs
the walk plus one reducer call per write since the last snapshot: with
`add_messages` on `InMemorySaver`, 25 ms at 2,048 messages with a
snapshot every 50 writes, and 0.3 s at 1,998 or 0.9 s at 4,998 messages
with the default 1000. After one run, reads take 6 to 16 ms.
`test_delta_channel_to_plain.py` covers every saver; all but the
plain-thread test fail on main.
JS: langchain-ai/langgraphjs#3017
2026-10-13 20:47:19 -04:00
gethin-langchain
8a77332d0d
release(cli): 0.4.34 ( #9300 )
...
Bumping the CLI to 0.4.34 to cut a release including #9243 (--json on
deploy listeners list).
2026-10-13 16:32:51 +01:00
gethin-langchain
a1ce197234
feat(cli): add --json to deploy listeners list ( #9243 )
...
## Summary
`deploy listeners list` only prints a human-readable table, which a
deploy automation pipeline can't reliably parse to extract a listener's
id for `--listener-id`.
Adds `--json`, which prints the listeners as a JSON array instead of the
table. An empty workspace prints `[]` rather than the "No listeners
found" sentence, so callers never need to special-case the no-results
path when scripting against it.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] `test_deploy_listeners_list_command_json` and
`test_deploy_listeners_list_command_json_no_results` in `test_cli.py`,
mirroring the existing table-output test pair
- [x] Full `libs/cli` suite: 529 passed, no regressions
2026-10-13 15:43:03 +01:00
Elior Nataf Lackritz
afbe7e48b1
release(checkpoint-postgres): 3.1.3 ( #9287 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointpostgres==3.1.2`:
- #8617 - widen `Store` `put` value type to `Mapping[str, Any]`
- #8556 - derive the delta walk cursor once the target loads
- #8544 - order delta channel replay by task path
- #9217 - validate namespace labels before store dispatch
- #9248 - start the delta walk at the target
- #9262 - treat an empty `checkpoint_id` as the latest in delta history
Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised
the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it.
2026-10-12 22:57:04 +00:00
Elior Nataf Lackritz
1074714c26
release(checkpoint-sqlite): 3.1.2 ( #9288 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointsqlite==3.1.1`:
- #8617 - widen `Store` `put` value type to `Mapping[str, Any]`
- #8557 - walk delta ancestors by parent pointer
- #8544 - order delta channel replay by task path
- #9217 - validate namespace labels before store dispatch
- #9262 - treat an empty `checkpoint_id` as the latest in delta history
Follows `checkpoint==4.3.0`, which is already live on PyPI. #8544 raised
the floor to `langgraph-checkpoint>=4.3.0`, so this release needs it.
2026-10-12 22:47:17 +00:00
Elior Nataf Lackritz
740461ed50
release(sdk-py): 0.4.7 ( #9289 )
...
Bumps the Python SDK version from 0.4.6 to 0.4.7. A thread stream's run
now ends only on the root graph's `completed` or `failed` event, not a
subgraph's, so `thread.output` no longer reads the state too early and a
run that fails after a subgraph finishes is reported as failed (#9228 ).
2026-10-12 22:47:05 +00:00
Igor Soarez
08a345637f
release(langgraph): 1.2.15 ( #9283 )
...
Bumps langgraph from 1.2.14 to 1.2.15. It now requires
langgraph-checkpoint 4.3.0 or later (#8544 ).
Also includes:
- Order delta channel replay by task path (#8544 )
- Replay a resumed exit-mode run's delta writes in live order (#9114 )
- Give each `bulk_update_state` update its own task id (#9128 )
- Stop `astream_events` dropping control/interrupts on v1/v2 (#9219 )
- Never store exit-mode delta writes under the null task id (#9229 )
- Mark a resume value that fails an interrupt's `response_schema`, so
`ToolNode` can stop swallowing it once langgraph-prebuilt is released
(#9232 )
- Don't save a checkpoint past a failed DeltaChannel write (#9235 )
- Keep a fork's DeltaChannel snapshot from starting nodes that never ran
(#9264 )
- Snapshot a DeltaChannel that an `update_state` Overwrite resets
(#9263 )
- Read a run's DeltaChannel input back only on its own checkpoints
(#9260 )
- Store an `update_state` input's writes on the checkpoint it updates
(#9258 )
- Keep an exit run from a checkpoint the thread moved past out of its
newer branch (#9269 )
- Stop at an `interrupt_before` breakpoint when a drain is requested
before it (#9281 )
- Save a cached node's writes like a node that ran (#9259 )
- Give every message written to a messages DeltaChannel an id (#9275 )
2026-10-12 18:34:01 -04:00
Elior Nataf Lackritz and Harsh Shroff
b7d053b256
fix(langgraph): give every message written to a messages DeltaChannel an id ( #9275 )
...
A DeltaChannel replays its saved writes on every read, and
`_messages_delta_reducer` doesn't fill in missing ids, so the loop gives
messages their ids before saving them (`ensure_message_ids`). That
missed several cases:
- Strings and `(role, content)` tuples, alone or in a list (`[("user",
"hi")]`), and messages inside an `Overwrite` were saved with no id, so
nothing could target them by id, for example `RemoveMessage`. A regular
messages channel gives them ids.
- A raw `Pregel` graph's input to a DeltaChannel got its ids after it
was applied, and none with exit durability or on a new thread; a dict
given as input read back with an id its nodes never saw. A
`Command(update=...)` sent to an older checkpoint got none either.
Now, in a DeltaChannel whose reducer is `_messages_delta_reducer`, every
message-like the reducer accepts becomes a message with an id before the
writes are saved or applied: in `put_writes`, before input is applied,
for a forked `Command`, and in `update_state`. Anything that can't
become a message is left as it is, so it fails where it always has.
Other DeltaChannels keep the rule they had (message objects, and message
dicts in a list, get ids), since they may hold other data and
deepagents' messages channel, which uses its own copy of the reducer,
relies on it; the dicts in an `Overwrite` there are left as they are.
Lists and dicts the caller passed in are never changed: a write that
changes is replaced. So the id step can recognize the reducer without an
import cycle, `_messages_delta_reducer` now lives in
`langgraph.pregel._messages`; `langgraph.graph.message` re-exports it.
Visible changes: in a messages DeltaChannel, a node's update streams as
messages with ids, and a string is stored as a message (about 170 bytes
more each).
JS twin: langchain-ai/langgraphjs#2992 . Thanks to @HarshShroff for
testing every `Overwrite` form and for the tuple fix.
## Tests
`test_delta_channel_id_stability.py` and
`test_delta_channel_update_state.py`: a write of every shape the reducer
accepts gets an id that every read keeps, as input, from a node and
through `update_state` (sync, async and as input); a list written twice
adds its messages twice and stays as it was; a forked `Command` gets an
id; a message dict the reducer rejects in a list still fails the run
before it's saved; a raw `Pregel` input gets an id on a new thread with
every durability, and its nodes see the ids that are saved; another
DeltaChannel keeps the dicts in an `Overwrite`. 36 of the 87 tests in
these files fail on main. The langgraph and prebuilt suites pass, and
lint is clean.
---------
Co-authored-by: Harsh Shroff <29751900+HarshShroff@users.noreply.github.com >
2026-10-12 20:33:45 +00:00
Elior Nataf Lackritz
395c145c04
fix(langgraph): save a cached node's writes like a node that ran ( #9259 )
...
A node served from the node cache had its writes applied but never
saved: the loop only streamed them. Plain channels didn't notice, since
the next checkpoint stores their value, but a `DeltaChannel` is rebuilt
from the saved writes, so its saved state lost the cached node's write
for good, under every durability. With `a -> b -> c` and `b` cached, a
second thread read back `log` as `a, c` next to `plain` as `a, b, c`.
The loop now saves a cache hit with `put_writes`, like a node that ran,
in all six places it matches cached writes. A new `cached` flag keeps
the hit streamed as cached and stops `put_writes` from writing it back
to the cache, which would also restart its TTL. A hit now costs the
saver write the node makes when it runs, and a cached `@task` call's
result is saved the same way.
The sync loop also stops caching a node that failed or was interrupted,
as the async loop already did: a cached error made the next run with the
same input skip the node without raising.
Found in review of langchain-ai/langgraphjs#2969 . JS twin:
langchain-ai/langgraphjs#2980
## Tests
- `test_delta_channel_node_cache.py`: `b` runs on the first thread and
is a cache hit on the second, under every durability, with `invoke` and
`ainvoke`. Every checkpoint of the second thread reads the same in the
DeltaChannel and a plain channel, and the cache is written once. All 6
cases fail on main; without the `cached` check in `put_writes`, they
fail on the cache count.
- `test_a_node_that_fails_is_not_cached`, with `invoke` and `ainvoke`: a
cached node that raises raises again on the next thread. The sync case
fails on main.
- The two tests that spy on `PregelLoop.put_writes` pass the new keyword
through.
- `make format`, `make lint_package`, `make lint_tests`, and the
`langgraph`, `prebuilt` and `cli` suites pass (without Redis).
2026-10-12 14:24:38 -04:00
Igor Soarez
10f1fabb3b
fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it ( #9281 )
...
When a drain is requested during the step right before an
interrupt_before breakpoint, the run stops with GraphDrained and the
breakpoint is lost: resuming the run skips it unintentionally.
The fix moves the drain check in tick() after the breakpoint check, so
breakpoints win over draining.
JS twin: langchain-ai/langgraphjs#3009
2026-10-12 18:29:56 +03:00
Elior Nataf Lackritz
799c2f04fd
fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch ( #9269 )
...
An exit-durability run that starts from a checkpoint the thread has
moved past, addressed by `checkpoint_id`, stores its DeltaChannel writes
on that checkpoint. The branch that already grew from it reads the
writes stored there, so its checkpoints picked up this run's writes too:
```python
graph.invoke({"log": ["in1"]}, config) # nodes a and b add "a1", "b1"
turn_1 = graph.get_state(config).config
graph.invoke({"log": ["in2"]}, config)
turn_2 = graph.get_state(config).config
graph.invoke({"log": ["in3"]}, turn_1, durability="exit")
graph.get_state(turn_2).values["log"]
# ["in1", "a1", "b1", "in3", "a3", "b3", "in2", "a2", "b2"], was ["in1", "a1", "b1", "in2", "a2", "b2"]
```
Sync and async durability store each step's writes on the run's own
checkpoints, so they weren't affected. The run now snapshots the
DeltaChannels it wrote instead, as a run's input already does on a
checkpoint a `checkpoint_id` addressed (#9260 ). That costs one snapshot
of each channel the run wrote, even when the addressed checkpoint is the
latest one. Threads that already hit this keep the wrong values on the
existing branch.
Found by @hntrl in review of langchain-ai/langgraphjs#2974
([repro](https://gist.github.com/hntrl/2185e489abe22147b3f6f77010c18264 )).
JS twin: langchain-ai/langgraphjs#2989
## Tests
`test_delta_channel_exit_mode.py`: one and two exit runs from the end of
turn 1, after turn 2, leave every checkpoint's DeltaChannel equal to a
plain reducer channel. Both fail on main on every saver in the fixture.
The `langgraph` suite passes (without Redis), and lint is clean.
2026-10-11 08:51:09 -04:00
Elior Nataf Lackritz
b4991f1ba3
fix(langgraph): store an update_state input's writes on the checkpoint it updates ( #9258 )
...
`update_state(..., as_node="__input__")` stored its writes on the
checkpoint it saved. A DeltaChannel reads the writes stored on a
checkpoint's ancestors, not its own, so that checkpoint read back
without the input unless the channel snapshotted there, and once a later
checkpoint snapshotted, the input was gone for good. Only a raw `Pregel`
graph whose input channel is a DeltaChannel hits it, since a
`StateGraph`'s input goes to its start channel.
The input's writes now go on the checkpoint the update builds on, as a
node update's do. An update on a checkpoint the thread has moved past
stores nothing there and snapshots the DeltaChannels it writes on its
own checkpoint instead, the rule a node update already follows (#9165 ).
Both kinds of update now go through one helper, which also gives a
message an id before saving it, as the loop's `put_writes` does with
`ensure_message_ids`. Before, a message saved through `update_state`
without an id read back with id `None`, on the node path too, while the
same message from a node got one.
JS twin: langchain-ai/langgraphjs#2973 , where review found it.
## Tests
`test_delta_channel_update_state.py`, sync and async: an update as input
reads back on its checkpoint and after the next run, with
`snapshot_frequency` 1 and 2, and an update as input to an older
checkpoint stays out of its other branch. The frequency 2 and
older-checkpoint cases fail on main. Five more check that a message
saved through `update_state` gets an id every read keeps, on the node
path (latest and older checkpoint) and the input path, sync and async;
they fail on main. The langgraph suite passes, and `lint_package` and
`lint_tests` are clean.
2026-10-10 11:57:46 +00:00
Elior Nataf Lackritz
6aa0afba68
fix(checkpoint): default InMemorySaver delta history to the latest checkpoint ( #9257 )
...
`InMemorySaver.get_delta_channel_history` looked its target up by
`config["configurable"].get("checkpoint_id", "")`, so a config without a
`checkpoint_id` matched no checkpoint, and every channel came back with
no seed and no writes, which a `DeltaChannel` reads as empty. The base
implementation, `PostgresSaver` and `SqliteSaver` read from the thread's
latest checkpoint instead, as `get_tuple` does.
A missing id now resolves to the namespace's newest checkpoint id, with
the same `max` that `InMemorySaver.get_tuple` uses. Graphs always pass a
checkpoint id here, so only direct callers of the saver API were
affected, and a call with an id does the same work as before.
Thanks @Hotragn, who pinned this down on #8242 , where @longquanzheng's
branch had already fixed it.
JS twin: langchain-ai/langgraphjs#2979
## Tests
- `test_get_channel_writes_without_checkpoint_id_reads_the_latest` fails
on main (`{'messages': {'writes': []}}`).
- The `checkpoint`, `checkpoint-conformance`, `checkpoint-sqlite`,
`checkpoint-postgres` (Postgres 16), `prebuilt` and `langgraph` suites
pass, the last two without their Redis cases. The DeltaChannel
conformance suite also passes against `InMemorySaver`; CI skips that run
in `libs/checkpoint`, where the conformance package isn't installed, so
the new test lives in `test_memory.py`.
2026-10-10 00:59:20 +00:00
Elior Nataf Lackritz
12aeb0fddb
fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints ( #9260 )
...
A raw `Pregel` graph whose input channel is a DeltaChannel saved a run's
input to it as a `NULL_TASK_ID` write on the checkpoint the run started
from, under `"sync"` and `"async"` durability. Readers apply a
checkpoint's `NULL_TASK_ID` writes as its own state, so:
- on a new thread that checkpoint is never saved, and the first run's
input was lost for good: after `{"log": [0], "plain": [0], ...}`, `log`
read `[2]` next to `plain` `[0, 2]`;
- the last checkpoint of a run read the next run's input;
- a run with input from an older checkpoint (`checkpoint_id`) leaked its
input into the branch that already grew from it, and read that branch's
input when it had one.
The input's writes now go on the checkpoint the run starts from under a
task id of their own, `uuid5(checkpoint_id, INPUT)`, the one
`update_state` uses for an input update. On a new thread, or a
checkpoint a `checkpoint_id` addressed, which may already have children
that would read them, nothing is stored there and the input checkpoint
snapshots the channel instead. A normal run stores the same write as
before, and `durability="exit"`, which already kept the input right, is
unchanged. Threads saved before this keep the input writes already
stored on their checkpoints.
A `StateGraph` routes its input through its start channel, so only raw
`Pregel` graphs hit this.
JS twin: langchain-ai/langgraphjs#2981
## Tests
`test_delta_channel_run_input.py`, under every durability, with `invoke`
and `ainvoke`: two runs on a new thread, and a run with input from an
older checkpoint whose other branch had DeltaChannel input or none.
Every checkpoint reads the same in the DeltaChannel and a plain channel.
The 12 sync and async cases fail on main, and dropping the task id, the
new-thread snapshot or the addressed-checkpoint snapshot each fails its
own cases. The `langgraph` and `prebuilt` suites pass (without Redis),
and `lint_package` and `lint_tests` are clean.
2026-10-09 15:59:10 -04:00
Elior Nataf Lackritz
d05236f805
fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets ( #9263 )
...
A node that writes an `Overwrite` to a DeltaChannel makes the loop
snapshot the channel on the checkpoint that superstep saves, so no read
replays across the reset. The same write through `update_state`, as a
node or as input, didn't snapshot: the value read back right, but reads
of the update's checkpoint and the ones after it walked back past the
reset to the last snapshot. `update_state` now snapshots a DeltaChannel
an `Overwrite` resets, as the loop does.
Raised in review of langchain-ai/langgraphjs#2973 . JS twin:
langchain-ai/langgraphjs#2982
## Tests
`test_delta_channel_update_overwrite.py`, sync and async: an `Overwrite`
through `update_state` as a node, and as input to a raw `Pregel` graph,
snapshots the channel on the checkpoint the update saves, and the value
reads back as the overwrite. All four fail on main. The `langgraph`
suite passes (without Redis), and `lint_package` and `lint_tests` are
clean.
2026-10-09 15:26:16 -04:00
Elior Nataf Lackritz
9d92f33cca
fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran ( #9264 )
...
A fork from a checkpoint with pending writes to a DeltaChannel snapshots
the channel on the fork's first checkpoint, so the fork doesn't replay
the other branch's writes. If the channel had never been written there,
the snapshot also gives it its first version, and `_mark_bumps_seen`
only marked the bump seen for nodes that already have a `versions_seen`
entry. A node subscribed to the channel that never ran has none, so the
bump started it, and it read the empty value before the node that writes
the channel had run:
```python
graph.invoke("go", config) # writer writes [1] to d, reader reads [1]
fork = graph.update_state(first_checkpoint, {"a": "go"}, as_node="__input__")
graph.get_state(fork).next # ("writer", "reader"): resuming runs reader on [] first
```
A replay from that checkpoint saves the same kind of fork from the loop.
A channel bumped from no version was never written, so
`create_checkpoint` now also marks the bump seen for the nodes the
channel triggers, from the graph's `trigger_to_nodes`, at every call
that can bump. Only raw `Pregel` graphs hit this: `StateGraph` nodes
trigger on their `branch:to:*` channels, not on state keys. An
`as_node="__copy__"` fork still starts such a node, with a plain list
channel as well, so that case isn't DeltaChannel-specific and isn't
changed here.
Raised in review of langchain-ai/langgraphjs#2974 . JS twin:
langchain-ai/langgraphjs#2983
## Tests
`test_delta_channel_seal_subscribers.py`: an update as input (sync and
async) and a replay from the checkpoint before a DeltaChannel's first
write leave only the writer next, and the reader then reads the written
value once. All three fail on main. The `langgraph` suite passes
(without Redis), and `lint_package` and `lint_tests` are clean.
2026-10-09 14:36:27 -04:00
Elior Nataf Lackritz
26356227c4
test(checkpoint): run the delta conformance suite against InMemorySaver in CI ( #9261 )
...
The conformance self-test in `libs/checkpoint-conformance` ran every
capability against `InMemorySaver` but asserted only the base ones.
`libs/checkpoint/tests/test_conformance_delta.py`, which ran the delta
conformance tests against it, always skips in CI: `libs/checkpoint`
can't depend on the conformance package, which depends on it. So no CI
job checked `InMemorySaver.get_delta_channel_history` against the delta
conformance tests.
The self-test now asserts every capability `InMemorySaver` implements,
and the skipped copy is gone.
## Tests
- With `InMemorySaver.get_delta_channel_history` broken to return no
history, the self-test now fails on 7 of the 10 delta conformance tests;
on main it still passes.
- `make format`, `make lint` and `make test` pass in
`libs/checkpoint-conformance`.
2026-10-09 13:44:55 -04:00
Elior Nataf Lackritz
a5dbacae0d
fix(checkpoint-postgres,checkpoint-sqlite): treat an empty checkpoint_id as the latest in delta history ( #9262 )
...
`PostgresSaver` and `SqliteSaver`, sync and async, read a DeltaChannel's
history from the latest checkpoint only when the config's
`checkpoint_id` was missing or `None`. An empty one was looked up as an
id, matched nothing, and came back with no seed and no writes, while
their own `get_tuple` treats an empty id as the latest checkpoint, as
the default implementation does. They now check for a missing or empty
id the way `get_tuple` does. The in-memory saver gets the same in #9257 .
Graphs always pass the id of a saved checkpoint, so only direct callers
of the saver API hit this.
## Tests
-
`test_{sync,async}_empty_checkpoint_id_reads_from_the_latest_checkpoint`
in `checkpoint-postgres/tests/test_delta_pagination.py` and
`checkpoint-sqlite/tests/test_delta_parent_walk.py`: all four fail on
main.
- The `checkpoint-postgres` (Postgres 16) and `checkpoint-sqlite` suites
pass, and `lint_package` and `lint_tests` are clean in both.
2026-10-09 13:44:51 -04:00
Elior Nataf Lackritz and iroiro147
cba111d8d6
fix(langgraph): don't save a checkpoint past a failed DeltaChannel write ( #9235 )
...
A DeltaChannel is rebuilt from its writes along the parent chain, so a
checkpoint saved without one of them reads back short for good. If
saving a DeltaChannel write failed (a database blip, say), the next
checkpoints were saved anyway and the channel lost that write, while
plain channels kept it. Three things let that happen:
- the sync loop waited for the delta writes before saving a checkpoint,
but never checked that they succeeded;
- both loops saved a checkpoint even when the previous save had failed,
so it pointed at a parent that was never saved;
- each save took the pending write list only when it started in the
background, and saves can start out of order, so a save could take a
later checkpoint's writes and not wait for its own. Waiting on writes
queued behind it, a save could also hang a sync run with
`durability="async"` (the default) once every worker was such a save: on
a 15-core machine a loop of 100 fast steps hung every time with default
settings, and with `max_concurrency=1` three steps are enough.
Now `_put_checkpoint` hands each save the writes submitted before it,
and a save fails if one of them or the previous save failed. The run
raises the write's error as before, the thread stays at its last
checkpoint that has all its writes, and running it again reruns the
task. For graphs without a DeltaChannel, a failed save now also stops
the later saves of that run, as JS already does, instead of saving
checkpoints whose parent is missing.
Thanks @shivangsharma01 for reproducing this in #8234 , and @iroiro147,
whose #8299 had the first two changes before the issue-assignment check
closed it. Thanks also to @HarshShroff for the failed-save test case.
JS twin: langchain-ai/langgraphjs#2969
## Tests
`test_delta_channel_write_failures.py`:
- a saver fails one delta write once; on every durability, with `invoke`
and `ainvoke`, every saved checkpoint matches a plain channel and a
retry gets the write back. The `invoke` cases and `ainvoke` with
`durability="async"` fail on main.
- a saver fails the save of the checkpoint after `a` once; with `invoke`
and `ainvoke`, every saved checkpoint matches a plain channel and a
retry finishes the run. The `durability="async"` cases fail on main,
which saves the later checkpoints on top of the missing one.
- a delta graph run with `max_concurrency=1` finishes. It hangs on main.
Reverting any one of the three changes fails at least one of these.
`make format`, `make lint` and the langgraph suite pass. A 100-step
benchmark (delta and plain channels, every durability, with and without
1 ms of saver latency) makes the same saver calls and runs in the same
time as main, except for the case that hangs on main.
---------
Co-authored-by: iroiro147 <265728356+iroiro147@users.noreply.github.com >
2026-10-09 12:48:24 +00:00
Elior Nataf Lackritz
93a5a28008
perf(checkpoint-postgres): start the delta walk at the target ( #9248 )
...
Reading a DeltaChannel at an older checkpoint (the state at a past
checkpoint, each entry of `get_state_history`, a fork or replay from
one) walked `checkpoints` down from the newest row, so every newer row
was read before the target's chain. A checkpoint's ancestors have
smaller ids, the order `get_tuple` already relies on to find the latest
checkpoint, so the walk now starts at the target: the first page is
`checkpoint_id <= target`, later pages stay `< cursor`.
The cursor is never NULL anymore, so the `(cursor IS NULL OR
checkpoint_id < cursor)` predicate goes too. Once Postgres caches a
generic plan for the prepared statement (`from_conn_string` sets
`prepare_threshold=0`), that predicate is a filter rather than an index
condition, and each later page re-read every newer row.
`get_delta_channel_history` on a 6,000-checkpoint thread with a snapshot
every 200 checkpoints, median of three runs of 60 reads each, same
results before and after:
| target | main | this PR |
|---|---|---|
| newest | 3.1 ms | 2.7 ms |
| 1,000 back | 4.5 ms | 2.9 ms |
| 3,000 back | 8.9 ms | 2.8 ms |
| 5,000 back | 15.7 ms | 2.8 ms |
The target is now always the first row read, so the pagination tests
from #8556 can no longer leave it off the first page; they are renamed
for what they still cover, a walk that continues across pages.
## Test plan
- [x] `test_{sync,async}_walk_reads_nothing_newer_than_the_target`
record the rows the walk reads; both fail on main, which also reads the
three newer checkpoints.
- [x] `checkpoint-postgres` suite on Postgres 16: 281 passed, 3 skipped.
- [x] `langgraph` DeltaChannel tests against this saver (`-k "delta and
not redis"`): 1,154 passed, 1 skipped.
2026-10-09 08:31:15 -04:00
bfcfea554e
fix(checkpoint,checkpoint-postgres,checkpoint-sqlite): validate namespace labels before store dispatch ( #9217 )
...
The SQLite and Postgres stores save a namespace as its labels joined
with `.`, so a label containing `.` could resolve to a different
namespace: `("foo.bar",)` and `("foo", "bar")` share the same row. This
rejects those labels at every entry point.
- `BaseStore` and `AsyncBatchedBaseStore`: `get`, `search`, `delete`,
and `list_namespaces` (sync and async) reject labels that are empty, not
strings, or contain `.`. The check runs before an op is queued, so one
caller's bad label can't fail other callers' concurrent requests.
- New `langgraph.store.base.validate_op_namespace(op)` applies the same
label checks to a single op. `SqliteStore`/`AsyncSqliteStore` and
`PostgresStore`/`AsyncPostgresStore` call it from `_group_ops` before
any SQL runs, which covers direct `batch`/`abatch` calls. Other stores
that serialize namespaces as delimited text can call it too.
- Unchanged: hierarchical prefix search, empty-prefix `search(())`, `*`
wildcards in `list_namespaces`, and the existing `put` rules.
## Release note
`get`, `search`, `delete`, and `list_namespaces` now raise
`InvalidNamespaceError` for labels that are empty, not strings, or
contain `.`, where they previously returned `None` or `[]` (or, on the
SQLite and Postgres stores, matched a different namespace). `put`
already rejected these labels, so nothing written through `put` becomes
unreachable.
## Release order
Release `langgraph-checkpoint` first. `langgraph-checkpoint-sqlite` and
`langgraph-checkpoint-postgres` import `validate_op_namespace`, so they
need the `langgraph-checkpoint` release that ships it. `main` already
has `libs/checkpoint` at 4.3.0 and requires
`langgraph-checkpoint>=4.3.0` in both stores (from #8544 ), so this must
merge before 4.3.0 is released; if 4.3.0 ships first, bump to the next
version and raise both requirements to it. That also guarantees the
pre-queue checks are installed: with an older `langgraph-checkpoint`, an
invalid op would fail inside the shared `abatch` and reject the calls
batched with it.
---------
Co-authored-by: Baihao Wang <byhow@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-08 16:10:55 -07:00
Elior Nataf Lackritz
93f5eaff21
fix(checkpoint): keep serialized data when an object can't be rebuilt ( #9251 )
...
Fixes #6970
If a checkpointed object can't be rebuilt on load (its module was
removed or renamed, or its constructor now rejects the stored fields),
`JsonPlusSerializer` returned `None` for it, so the value silently
disappeared from restored state. The constructor and method ext codes
now return the serialized payload instead, the same thing the pydantic
and blocked-type paths already do, and log a one-time warning per type.
The warning names the exception type only, since exception messages can
echo the stored value.
Thanks @yangbaechu for the report and repro. This takes the same
direction as #6972 by @pandego and #7152 by @SinzoL.
2026-10-08 16:01:46 -04:00
Baihao Wang
5965d72ff7
fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values ( #9232 )
...
**Problem.** `interrupt(response_schema=...)` checks a human's answer
when the graph resumes. If the answer doesn't match the schema, the
resume fails, nothing is saved, and the human can answer again (#8886 ).
That works when the interrupt runs in a graph node, but not when it runs
inside a tool: either the tool calls `interrupt()` itself, or it starts
a graph that does, such as a subagent called as a tool. There, the
resume returns normally and the interrupt disappears.
**Why.** `interrupt()` raises a `pydantic.ValidationError` for an
invalid answer. When one comes out of a tool, `ToolNode` assumes the
model passed bad arguments, so it hands the error to the model ("Error
invoking tool … Please fix the error and try again") and the run carries
on. The human never sees the error, the model is blamed for it, and the
interrupt is no longer pending.
**Fix.** `interrupt()` still raises the same `ValidationError`, but
marks it so a new helper, `langgraph.errors.is_invalid_resume(error)`,
can recognize it. `ToolNode` re-raises these errors instead of handing
them to the model, whatever `handle_tool_errors` is set to, so a bad
answer fails the resume the same way inside a tool as outside one:
nothing is saved and the interrupt can be answered again. Every other
`ValidationError` from a tool is handled as before.
**Also fixed, in the same error handling.** With `wrap_tool_call` set
and a `handle_tool_errors` other than the default (for example `True`),
`ToolNode` turned any exception from the wrapper into an error
`ToolMessage`, including `GraphInterrupt`. So an interrupt in that setup
never paused: the model got `Error: GraphInterrupt(...)` instead.
Interrupts now propagate there too, as they already do without a
wrapper. `create_agent` uses the default handler, so it was not
affected.
**Compatibility.** Not a breaking change: the error type is unchanged.
Worth a careful look: a wrapped `ToolNode` with a non-default
`handle_tool_errors` now pauses on interrupts instead of returning them
to the model as errors. With an older `langgraph` that doesn't have
`is_invalid_resume`, `ToolNode` keeps today's behavior.
2026-10-08 12:59:25 -07:00
Elior Nataf Lackritz
40a2e6d845
fix(langgraph): never store exit-mode delta writes under the null task id ( #9229 )
...
In exit mode, a run stores its DeltaChannel writes on the checkpoint it
started from, under synthetic task ids that put the superstep first. For
a `Command`'s writes in a run whose first superstep is 0, that id came
out as `NULL_TASK_ID` itself. Readers take writes under `NULL_TASK_ID`
for the checkpoint's own pending writes, so after
`invoke(Command(update=...), durability="exit")`:
- on a new thread, `get_state` on the empty first checkpoint showed the
update in the DeltaChannel but not in a plain channel;
- on a thread whose first checkpoint came from `update_state(...,
as_node="__input__")`, `get_state` on that checkpoint showed the update
the same way, and a replay or fork from it applied the update to the
DeltaChannel only.
`exit_delta_task_id` now never returns `NULL_TASK_ID`. Threads already
saved this way stay as they are.
## Tests
- `test_command_update_on_an_input_checkpoint_matches_a_plain_channel`
compares every checkpoint in the history, and a replay from the input
checkpoint, with a plain channel, on every checkpointer and durability.
The exit cases fail without the fix.
- `test_exit_command_update_on_a_new_thread_matches_a_plain_channel`
compares every checkpoint in a new thread's history with a plain
channel, on every checkpointer, and fails without the fix. It runs in
exit mode only: in sync and async the two channels already differ on
`main`, because of a separate bug that applies a new thread's `Command`
update twice.
`make format`, `make lint` and the langgraph suite pass.
2026-10-07 19:17:02 -04:00
Elior Nataf Lackritz
a0053bb616
fix(sdk-py): end a thread stream's run only on a root lifecycle event ( #9228 )
...
The thread stream's lifecycle watcher ended the run on any `completed`
or `failed` lifecycle event, including the one a subgraph sends when it
finishes. So `thread.output` could read the thread state before the
parent stored the step that ran the subgraph, and a run that failed
after a subgraph completed was reported as completed. The async and sync
watchers now end the run only on a root event, with the
`_is_root_terminal_lifecycle` check the fanout already uses. The JS SDK
checks the root namespace here too.
This is the `sdk-py integration` flake where the final `items` comes
back as `['streamed', 'tool', 'asked']` without `'sub'`: the example
graph's last node runs a subgraph.
## Tests
New async and sync tests send a subgraph `completed` and then a root
`failed`. Without the fix the run ends as completed. `make lint` and
`make test` in `libs/sdk-py` pass.
2026-10-07 19:03:46 -04:00
Igor Soarez
87f1c8eb9a
fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 ( #9219 )
...
### Problem
`Pregel.astream_events` declared `interrupt_before`, `interrupt_after`
and
`control` as keyword-only parameters, but forwarded them only on the
`version="v3"` branch. On async `version="v1"`/`"v2"` the values were
bound to
named parameters and never entered `**kwargs`, so they were silently
dropped
on the way to `astream` — no error, no effect:
- `request_drain()` on a caller-supplied `RunControl` did nothing; the
graph
created its own control and ran to completion.
- Static interrupts passed as `astream_events(...,
interrupt_before=[...])`
never fired.
This is a regression introduced by #7677 (first released in `1.2.0a3`).
Before that, `Pregel` did not override `astream_events`, and these
keywords
reached `astream` through `**kwargs` — langchain-core's v1 and v2 event
implementations both forward caller kwargs to `astream`
(`tracers/log_stream.py`, `tracers/event_stream.py`).
Downstream impact: langgraph-api passes run-level `interrupt_before` /
`interrupt_after` into `graph.astream_events(..., version="v2",
**kwargs)` for
runs with `stream_mode="events"` (`models/run.py`, `stream.py`), so
server
runs using that stream mode have silently dropped static interrupts
since
langgraph 1.2.0a3.
Sync `stream_events(version="v1"/"v2")` is unaffected: langchain-core
raises
`NotImplementedError` there, so there was no working sync path to break.
### Fix
Remove the three parameters from the public runtime implementations of
`stream_events` / `astream_events` (and from the explicit passing in
their v3
dispatch calls), so the values travel through `**kwargs` again:
- **v1/v2** recover the pre-#7677 passthrough. `astream` receives
exactly what
the caller passed — a supplied value, an explicit `None`, or nothing for
an
omitted argument.
- **v3** is unchanged. The values bind on `_pregel_stream_v3` /
`_apregel_stream_v3`, which keep their named parameters and
since-inception
(#7519 , `1.2.0a1`) explicit-`None` defaults: an omitted argument arrives
at
`astream` as `None`, exactly as before.
What `astream` receives after this change:
| caller supplies | async v1/v2 | v3 (sync and async) |
|---|---|---|
| nothing | argument absent | explicit `None` |
| explicit `None` | `None` | `None` |
| a value | the value | the value |
The typed `version="v3"` `@overload` stubs are untouched, so v3 call
sites
keep their static types (invalid values still fail `ty` there, same as
on
`main`). `RemoteGraph` and the v3-only `transformers` parameter are
untouched.
Complexity: net −24 lines in `main.py` with no branches, sentinels or
wrappers added. The public capture-and-drop pattern that caused the bug
is
gone; the two private helpers each have a single call path and forward
unconditionally, so they cannot drop anything.
Docstrings now describe the three parameters as honored on every async
version (type-checked only on the v3 overloads), and no longer promise
synchronous v1/v2 event streaming, which langchain-core does not
implement.
### Compatibility notes
- The three parameters were keyword-only, so no caller can break;
keyword
callers bind through `**kwargs` identically.
- The names leave the runtime signatures (`inspect.signature`), while
the v3
overloads keep the typing.
- v3 is unchanged: `_pregel_stream_v3`/`_apregel_stream_v3` still
default all
three to `None` and pass them explicitly, so an override's non-`None`
default never applied on v3 and still doesn't. The only behavior change
beyond restoring the pre-#7677 passthrough is on v1/v2 with an explicit
`None`: since 1.2.0a3 the named-parameter capture dropped it, so an
override's non-`None` default was silently applied instead; now the
explicit `None` reaches `astream`, as it did before 1.2.0 and as it does
on
v3.
### Testing
New tests in `tests/test_stream_events_v3_kwarg_forwarding.py`:
- `interrupt_before` / `interrupt_after` / pre-drained `control`
parametrized
over v1/v2/v3 (12 of them fail on unpatched `main`).
- Sync v3 static interrupts.
- Mid-run drain: a node calls `request_drain()`; asserts `GraphDrained`
propagates, the caller's own `RunControl` was used, and the checkpoint
keeps the pending step.
- Recording tests pin, for all three names and on both the async and
sync v3
paths, exactly what `(a)stream` receives: supplied values (with
`control`
identity), explicit `None`, and absence for omitted arguments.
Verified by mutation: replacing the implementation with each rejected
alternative (unpatched parent; injecting `None` for omitted kwargs on
v1/v2;
dropping explicit `None` on v1/v2; kwargs-only private helpers) makes
the
corresponding tests fail.
Suites: 246 passed on the four adjacent streaming test files; 906 passed
/
1 skipped across every test file calling `(a)stream_events` plus
`test_runtime.py`. `ruff check` / `format --check` clean; `ty check
langgraph`
clean.
Not verifiable locally (CI please): Python 3.10 (the new tests carry no
version skip), minimum supported langchain-core, and a live
langgraph-api
server run.
### Release note
> Fixed a regression since 1.2.0a3: `Pregel.astream_events` silently
dropped
> `interrupt_before`, `interrupt_after` and `control` for
> `version="v1"`/`"v2"`. Static interrupts and `RunControl` drains now
work on
> every async version. Server runs using `stream_mode="events"` were
affected
> and get their static interrupts back.
2026-10-07 12:26:50 -04:00
gethin-langchain
736a18eaab
release(cli): 0.4.33 ( #9227 )
...
Bumping the CLI to 0.4.33 to cut a release including #9221 (deploy
listeners list) and #9222 (--image-uri).
2026-10-07 09:19:34 -04:00
gethin-langchain
ec4f8535f8
feat(cli): add --image-uri to deploy an already-pushed image ( #9222 )
...
## Summary
`--push-to` always builds (or retags a local `--image`) and pushes, even
when the image already exists at the destination. That breaks CI/CD
pipelines where the build/push step and the deploy step run in separate
jobs: the deploy job has no local copy of the image to retag, and
`--image` requires one (it runs `docker image inspect`, which needs the
image present in the local Docker daemon).
This adds `--image-uri`, which takes a full image reference already in a
registry and deploys it directly via `source_revision_config.image_uri`,
with no local Docker involvement at all: no inspect, no build, no tag,
no push. It gets the same placement behavior as `--push-to`
(`--listener-id`/`--k8s-namespace`, or auto-selecting the sole listener)
and the same update-in-place semantics, since both produce an
`external_docker` deployment and are interchangeable on the same
deployment.
`--image-uri` requires a digest (`repo@sha256:...`) and rejects
empty/blank input. `--push-to` always resolves to a digest after
pushing; `--image-uri` has no push step to resolve one from, so a
mutable tag (or an unvalidated empty string) could let Kubernetes
silently keep running a previously cached image while the CLI reports
success.
Implementation: `CustomerRegistrySource`'s image-acquisition step is
split into two variants, `BuildAndPush` (the existing
`--push-to`/`--image` flow, unchanged behavior) and `PublishedImage`
(the new flag), so create/update/placement logic stays shared. Also
reworded `_ensure_customer_registry_source`'s error, which previously
mentioned only `--push-to` even though it's reachable from `--image-uri`
too.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] Unit tests in `test_deploy_helpers.py` for `_select_source`
selecting `PublishedImage` (by digest, trimmed), requiring no local
Docker, carrying placement, and the mutual-exclusivity + validation
errors (`--push-to`, `--image`, `--tag`, `--remote`, empty/blank input,
missing digest)
- [x] CLI-level tests in `test_deploy_command.py`: create and update an
external deployment via `--image-uri` with zero Docker calls, listener
auto-placement, rejecting a non-external existing deployment (now
mentioning both flags), and the conflicting-flag cases end to end
- [x] Full `libs/cli` suite: 524 passed, no regressions
2026-10-07 13:32:46 +01:00
gethin-langchain
ce14d33687
feat(cli): add 'langgraph deploy listeners list' ( #9221 )
...
## Summary
Originally this auto-selected a workspace's sole listener for
self-hosted/hybrid control planes the same way #9056 already does for
Cloud. Per review, that's reverted: in self-hosted environments, leaving
placement blank is the deliberate signal to deploy to the bundled
operator, not an unresolved default. Auto-selecting a sole listener
there would silently take that option away from anyone who has both a
bundled operator and one listener configured, with no way to get it
back.
The actual need behind this was simpler: a way to find a listener's id
without hardcoding it, so it can be passed to `--listener-id`
explicitly. `HostBackendClient.list_listeners()` already existed and is
used internally for placement resolution, but had no CLI surface of its
own.
This adds `langgraph deploy listeners list`, mirroring the existing
`deploy list` / `deploy revisions list` pattern, to look up a
workspace's listeners and their namespaces. No change to default
placement behavior.
## Test plan
- [x] `make format && make lint` clean in `libs/cli`
- [x] `format_listeners_table` unit test in `test_util.py`
- [x] CLI-level tests for `deploy listeners list` (with and without
results) in `test_cli.py`
- [x] Full `libs/cli` suite: 508 passed, no regressions
2026-10-07 13:32:26 +01:00
dependabot[bot]
708aaa4ebc
chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph ( #9206 )
...
Bumps [notebook](https://github.com/jupyter/notebook ) from 7.5.7 to
7.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/releases ">notebook's
releases</a>.</em></p>
<blockquote>
<h2>v7.6.3</h2>
<h2>7.6.3</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.2...9c8d7c24006554dda8c5fc02c69f91d6449c712a ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.4 <a
href="https://redirect.github.com/jupyter/notebook/pull/8066 ">#8066</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-08-11&to=2026-09-21&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-08-11..2026-09-21&type=Issues ">activity</a>)</p>
<h2>v7.6.2</h2>
<h2>7.6.2</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.1...2f1f1622fc64e09b90ade87ed886fdfe1bc653fb ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Add nvd.nist.gov to the check_links ignore list <a
href="https://redirect.github.com/jupyter/notebook/pull/8032 ">#8032</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Backport JupyterLab dependency updater improvements <a
href="https://redirect.github.com/jupyter/notebook/pull/8031 ">#8031</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.6.3 <a
href="https://redirect.github.com/jupyter/notebook/pull/8030 ">#8030</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Switch local pre-commit hooks to language: system <a
href="https://redirect.github.com/jupyter/notebook/pull/8002 ">#8002</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Documentation improvements</h3>
<ul>
<li>Update 'notebook v7 proposal' link in doc <a
href="https://redirect.github.com/jupyter/notebook/pull/8004 ">#8004</a>
(<a href="https://github.com/brichet "><code>@brichet</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-07-22&to=2026-08-11&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/brichet "><code>@brichet</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Abrichet+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)
| <a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)</p>
<h2>v7.6.1</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/blob/@jupyter-notebook/tree@7.6.3/CHANGELOG.md ">notebook's
changelog</a>.</em></p>
<blockquote>
<h2>7.6.3</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.2...9c8d7c24006554dda8c5fc02c69f91d6449c712a ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.4 <a
href="https://redirect.github.com/jupyter/notebook/pull/8066 ">#8066</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-08-11&to=2026-09-21&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-08-11..2026-09-21&type=Issues ">activity</a>)</p>
<!-- raw HTML omitted -->
<h2>7.6.2</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.1...2f1f1622fc64e09b90ade87ed886fdfe1bc653fb ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Add nvd.nist.gov to the check_links ignore list <a
href="https://redirect.github.com/jupyter/notebook/pull/8032 ">#8032</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Backport JupyterLab dependency updater improvements <a
href="https://redirect.github.com/jupyter/notebook/pull/8031 ">#8031</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.6.3 <a
href="https://redirect.github.com/jupyter/notebook/pull/8030 ">#8030</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Switch local pre-commit hooks to language: system <a
href="https://redirect.github.com/jupyter/notebook/pull/8002 ">#8002</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Documentation improvements</h3>
<ul>
<li>Update 'notebook v7 proposal' link in doc <a
href="https://redirect.github.com/jupyter/notebook/pull/8004 ">#8004</a>
(<a href="https://github.com/brichet "><code>@brichet</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-07-22&to=2026-08-11&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/brichet "><code>@brichet</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Abrichet+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)
| <a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-07-22..2026-08-11&type=Issues ">activity</a>)</p>
<h2>7.6.1</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.6.0...72c228d76d1a9e5aa81531f7cf3c6af410c5e53f ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update to JupyterLab v4.6.2 <a
href="https://redirect.github.com/jupyter/notebook/pull/7996 ">#7996</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/notebook/commit/dc710245bf156f11bafc6e7d283695253d6b5cd7 "><code>dc71024</code></a>
Publish 7.6.3</li>
<li><a
href="https://github.com/jupyter/notebook/commit/9c8d7c24006554dda8c5fc02c69f91d6449c712a "><code>9c8d7c2</code></a>
Update to JupyterLab v4.6.4 (<a
href="https://redirect.github.com/jupyter/notebook/issues/8066 ">#8066</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/ffc52152951a52ef4885f12521d7a5f8ebd2f9c1 "><code>ffc5215</code></a>
Publish 7.6.2</li>
<li><a
href="https://github.com/jupyter/notebook/commit/2f1f1622fc64e09b90ade87ed886fdfe1bc653fb "><code>2f1f162</code></a>
Update to JupyterLab v4.6.3 (<a
href="https://redirect.github.com/jupyter/notebook/issues/8030 ">#8030</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/63df75281ec7226826877f2e77dc68670b109c33 "><code>63df752</code></a>
Backport JupyterLab dependency updater improvements (<a
href="https://redirect.github.com/jupyter/notebook/issues/8031 ">#8031</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/66101117b79c92baf364d95647242f490807f18c "><code>6610111</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8032 ">#8032</a>:
Add nvd.nist.gov to the check_links ignore list (<a
href="https://redirect.github.com/jupyter/notebook/issues/8033 ">#8033</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/75a02cb28e7ed7a58358b69323be3d9e4800f941 "><code>75a02cb</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8004 ">#8004</a>:
Update 'notebook v7 proposal' link in doc (<a
href="https://redirect.github.com/jupyter/notebook/issues/8005 ">#8005</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/2b0ebe6584d3f6d59d458a9414f00c985ead4feb "><code>2b0ebe6</code></a>
Backport PR <a
href="https://redirect.github.com/jupyter/notebook/issues/8002 ">#8002</a>:
Switch local pre-commit hooks to language: system (<a
href="https://redirect.github.com/jupyter/notebook/issues/8003 ">#8003</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/e058ab3a0d98a4698f201e10d7de723c70150d34 "><code>e058ab3</code></a>
Publish 7.6.1</li>
<li><a
href="https://github.com/jupyter/notebook/commit/72c228d76d1a9e5aa81531f7cf3c6af410c5e53f "><code>72c228d</code></a>
Update to JupyterLab v4.6.2 (<a
href="https://redirect.github.com/jupyter/notebook/issues/7996 ">#7996</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/tree@7.5.7...@jupyter-notebook/tree@7.6.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-07 17:21:37 +09:00
Elior Nataf Lackritz
39c523eb0a
fix(langgraph): give each bulk_update_state update its own task id ( #9128 )
...
`bulk_update_state` stores each update's writes on the checkpoint it
updates, under a task id. An update whose node has no pending task to
reuse got `uuid5(checkpoint_id, INTERRUPT)`, so every such update in one
superstep shared an id. Savers keep one write per `(task_id, idx)`, so
all but the first update's writes were dropped.
Plain channels don't notice, since their value is stored in the new
checkpoint. A `DeltaChannel` rebuilds its value from those writes, so it
lost every update after the first, on memory, sqlite and postgres:
```python
graph.bulk_update_state(config, [[
StateUpdate({"d": ["u1"], "p": ["u1"]}, as_node="a"),
StateUpdate({"d": ["u2"], "p": ["u2"]}, as_node="m"),
]])
# plain: [..., 'u1', 'u2']
# delta: [..., 'u1']
```
The existing multi-update test only passed because it gave each update
an explicit `task_id`, and its docstring said so.
## Fix
The `i`th update gets `uuid5(checkpoint_id, f"{INTERRUPT}:{i}")`. The
first keeps the old id, so a single `update_state` stores exactly what
it did before. Updates that reuse a pending task's id, or pass their
own, are unchanged.
Each update also gets the task path `(__interrupt__, i)`, stored with
its writes. Live execution applies a superstep's updates in the order
given, and a saver that replays a checkpoint's writes by task path
(#8544 ) now gives them back in that order instead of by task id. Savers
whose `put_writes` takes no `task_path` get the old call.
## Limits
- On savers that order a checkpoint's writes by task id only (the
released ones, until #8544 ), several updates in one superstep still
replay in task id order.
- langgraphjs has the same shared id in `bulkUpdateState` and loses the
same update; fixed in langchain-ai/langgraphjs#2923 with the same ids.
## Tests
`test_delta_channel_update_state.py` adds sync, async and
next-to-a-pending-task cases across the checkpointer fixtures, with no
explicit task ids, on a thread that already has history (a fresh thread
snapshots every delta channel and hides the bug). All 19 fail on main.
Two more (sync and async) give six updates in one superstep and check
that `get_state` returns them in that order, on a saver that replays by
task path; they fail without the path.
2026-10-07 01:04:58 +00:00
3a1796ecf0
fix(langgraph): replay a resumed exit-mode run's delta writes in live order ( #9114 )
...
Depends on #8544
Resuming an exit-durability run after a parallel interrupt replays the
resumed checkpoint's `DeltaChannel` writes wrong: twice on `main`, out
of order if the duplicate is simply dropped. `p` finished before `q`
interrupted, and `r` runs after `q`:
```
live: ['in1', 'p', 'r']
main, reload: ['in1', 'p', 'r', 'p']
```
No fork is involved. Any exit-mode run that starts from a checkpoint
with pending delta writes hits it: resuming an interrupt, or retrying
after a task error.
## Cause
Exit durability stores a run's delta writes on the checkpoint it started
from, under step-prefixed task ids (`exit_delta_task_id`), so they
replay in superstep order. On a resume, that checkpoint already holds
the finished tasks' writes under their real task ids. The accumulator
stored those loaded writes again under a step-prefixed id, so they
replayed twice. Skipping them alone reorders the replay, because the
real ids sort after the step-prefixed ones.
## Fix
At exit:
- writes loaded with the checkpoint are skipped, since they are already
stored on it: `NULL_TASK_ID` writes by task id (this run's own `Command`
writes are recorded separately in `_first`), the rest by `(task_id,
channel)`;
- the checkpoint's own superstep keeps its real task paths, so it
interleaves with the loaded writes as live execution did, but gets a
step-prefixed task id. Under the real id, a resume whose final
checkpoint fails to save would leave the resumed task looking done, and
the retry would skip it and lose its other writes;
- a resume addressed by `checkpoint_id` reruns tasks whose writes are
already stored on the checkpoint; their writes to those channels are
skipped, and a write to a channel the task did not write before is kept;
- later supersteps get task id `ffffffff-<step>-...` and task path
`~~<step>...`, which sort after every real task id and every real task
path, in step order.
So superstep order holds whether a saver orders by task path (#8544 ) or
only by task id.
## Limits
- Within the resumed superstep, a saver that orders only by task id
replays this run's writes before the ones loaded from the checkpoint.
#8544 fixes that for the OSS savers.
- If the final checkpoint fails to save, the writes of supersteps after
the resumed one stay on the checkpoint and replay once more after the
retry (on `main`, every write does). That comes from exit durability
storing its writes before its checkpoint, not from this change.
## Tests
`test_delta_channel_exit_mode.py`, on the shared checkpointer fixture
(memory, sqlite, postgres) in all three durabilities:
- resume after a parallel interrupt with a later write, plain and with
the head's `checkpoint_id`
- the resumed superstep interleaved by task path: `a_asks` resumes after
`z_done` finished, and live order puts `a` first
- the same runs on a saver that orders writes by task id only
- a resume retried after its final checkpoint failed to save
- a resume with `Command(resume=..., update=...)` that writes the delta
channel replays that write once, in live order
- an addressed resume whose rerun task writes a delta channel it did not
write before keeps that write
The exit cases fail without the change, except the last one, which
guards against skipping by task id alone (an earlier version of this PR
did); sync and async pass either way.
#8548 marked exit durability in
`test_resume_on_an_interrupted_head_consumes_its_writes_without_a_snapshot`
as a strict expected failure for this bug; this PR drops the mark.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
---------
Co-authored-by: ErenAta16 <149434812+ErenAta16@users.noreply.github.com >
Co-authored-by: ragnarok268 <58264829+ragnarok268@users.noreply.github.com >
2026-10-06 22:05:55 +00:00
2b93e8b79f
fix: order delta channel replay by task path ( #8544 )
...
Fixes langchain-ai/langgraph#8382
`DeltaChannel` rebuilds its value by replaying ancestor writes through
the reducer. Every saver ordered a checkpoint's writes by `(task_id,
idx)`, but live execution applies a super-step's writes in task-path
order (`apply_writes` sorts tasks by `task_path_str(task.path[:3])`).
`task_id` is a hash of the path, so when two or more tasks write one
`DeltaChannel` in the same super-step, replay applies them in an
arbitrary permutation.
Reducers must be batching-invariant, not order-invariant, so the
permutation changes the value: `get_state` disagrees with what `invoke`
returned, and continuing the thread saves the reordered value as the
base for every later write.
## Fix
Replay orders by `(task_path, task_id, idx)`, the order
`SELECT_PENDING_SENDS_SQL` already uses for sends. `apply_writes` and
every saver now sort with one `writes_sort_key` from
`langgraph.checkpoint.base`, in Python, so live and replay can't drift
apart and don't depend on a database collation. `apply_writes` sorts by
the full task path, the string `put_writes` stores, instead of
`path[:3]`. The paths that reach `apply_writes` no longer carry task
ids, so the live order doesn't change.
`BaseCheckpointSaver`'s default `get_delta_channel_history` can't sort
by path, since `PendingWrite` has no task path, so it replays each
checkpoint's writes in `get_tuple` order. `get_tuple` now has to return
`pending_writes` in `writes_sort_key` order, and memory, SQLite and
Postgres do, so the default walk is right for any saver that follows
that. `AsyncPostgresSaver` also gets the sync
`get_delta_channel_history` that `AsyncSqliteSaver` already had; sync
reads used to fall back to the default walk.
Memory and Postgres already stored `task_path`. SQLite accepted it on
`put_writes` and dropped it, so `writes` gains the column and `setup()`
adds it to existing databases.
Writes without a task path (graph input, `update_state` updates, rows
written before the column existed) sort first by `task_id`, which is
also where live execution applies input.
## Compatibility
- Memory and Postgres already had `task_path` on disk, so existing
threads replay in the corrected order after upgrade.
- On SQLite, rows from before the upgrade read back as `''` and keep
their old order. Only new writes get the corrected order, since there is
no stored path to recover.
- SQLite has no `ADD COLUMN IF NOT EXISTS`, so `setup()` runs the
`ALTER` and treats `duplicate column name` as success, which also covers
two processes migrating one file. That error comes while SQLite prepares
the statement, before it asks for the write lock, so `setup()` on an
up-to-date database doesn't wait on other writers. A read-only database
from before the column is read with empty paths instead of failing
setup.
- Downgrade is safe: older code's `INSERT` omits the column and the
column has a default.
- `get_tuple` and `list` return `pending_writes` in `writes_sort_key`
order instead of task id order (SQLite, Postgres) or put order (memory).
Nothing in langgraph depends on the old order.
- Postgres reads `task_path` and `idx` with each pending write, so a
subclass that pairs `SELECT_SQL` with its own `_load_writes`, or the
other way round, has to match the new row shape.
- A third-party saver has to replay in `writes_sort_key` order: in its
own `get_delta_channel_history` if it has one, otherwise by returning
`pending_writes` from `get_tuple` in that order. Otherwise it fails the
new conformance tests; the `get_tuple` one is a base test, so it runs
for every saver.
- langgraph, checkpoint-sqlite and checkpoint-postgres import
`writes_sort_key` from langgraph-checkpoint, so this bumps
langgraph-checkpoint to 4.3.0 and requires it there. 4.3.0 has to be
released first.
## Limits
- Several updates in one `bulk_update_state` super-step share a task id,
so the saver keeps only the first one's writes and the `DeltaChannel`
loses the rest (plain channels are fine). That's on main too; #9128
fixes it and stores a task path per update, so with this PR those
updates also replay in the order given.
- Exit durability stores its writes differently; resume ordering there
is fixed in #9114 , stacked on this PR.
- langgraphjs applies `DeltaChannel` writes in task id order, live and
on replay (langchain-ai/langgraphjs#2544 ), so its reads match too.
Moving JS to task path order is a follow-up.
## Tests
Each fails on main and passes here:
- `test_delta_channel_parallel_order.py`, across memory, SQLite and
Postgres: parallel writers and a `Send` fan-out, comparing `get_state`
with the live result, including sync `get_state` on the async savers.
- Three conformance tests whose task ids sort opposite to their task
paths, so they cannot pass by chance: two on
`get_delta_channel_history`, one on `get_tuple`'s `pending_writes`
order.
- SQLite migration tests from a pre-column database, sync and async,
including a read-only file.
One more that passes on main too: SQLite `setup()` while another
connection holds the write lock, with no busy timeout, sync and async.
It keeps the `ALTER` from waiting on that lock.
Thanks to @ErenAta16 for the report, the reproduction, and for tracing
`task_path` through all three backends, and to @ragnarok268 for the
conformance-test design with task ids ordered opposite to their paths.
---------
Co-authored-by: ErenAta16 <149434812+ErenAta16@users.noreply.github.com >
Co-authored-by: ragnarok268 <58264829+ragnarok268@users.noreply.github.com >
2026-10-06 17:55:04 -04:00
Nick Hollon
70dd64065b
release(langgraph): 1.2.14 ( #9215 )
...
Bumps langgraph from 1.2.13 to 1.2.14.
Raises the minimum `langgraph-sdk` to 0.4.6, which percent-encodes
`thread_id` and `assistant_id` in thread stream requests (#9213 ). Remote
graph streaming uses those thread stream classes, so this keeps it on a
version with the fix.
Also includes:
- Keep DeltaChannel counters on every `update_state` path (#9142 )
- Keep an `update_state` on an older checkpoint out of its other
branches (#9165 )
- Fork before replaying an update checkpoint the thread moved past
(#9170 )
2026-10-06 10:35:44 -04:00
Nick Hollon
55b0e36c51
release(sdk-py): 0.4.6 ( #9214 )
...
Bumps the Python SDK version from 0.4.5 to 0.4.6. Percent-encodes
`thread_id` and `assistant_id` in thread stream requests (#9213 ).
2026-10-06 10:15:20 -04:00
Nick Hollon
d89c7e100e
fix(sdk-py): percent-encode thread_id and assistant_id in thread stream requests ( #9213 )
...
## Summary
Two REST helpers on the thread stream built their paths by interpolating
the raw identifier:
- `thread.agent.get_tree()` built `/assistants/{assistant_id}/graph`
- the state fetch behind `thread.output` built
`/threads/{thread_id}/state`
httpx collapses `..` segments and treats `#` as a fragment, so an
identifier containing those characters was rewritten into a different
path before the request was sent. Both now go through
`_quote_path_param` in the async and sync stream modules, matching the
other SDK endpoints and the stream transports.
## Tests
`tests/streaming/test_thread_stream_path_encoding.py` drives
`threads.stream(...)` followed by `thread.output` or
`thread.agent.get_tree()`, async and sync, with identifiers containing
`..`, `/`, and `#`. It asserts that the request path keeps each
identifier as a single encoded segment. All four tests fail without the
change.
`make format`, `make lint`, and `make test` pass in `libs/sdk-py`.
2026-10-06 09:57:28 -04:00
Elior Nataf Lackritz
2d942085e2
fix(langgraph): fork before replaying an update checkpoint the thread moved past ( #9170 )
...
Depends on #9165
A replay saves a fork checkpoint first, so its writes land on the fork. Two things still reached the checkpoint it replayed from, and through it every branch that already grew from that checkpoint.
It skips the fork for an update or fork checkpoint, which is already a branch of its own. Once the thread has moved past such a checkpoint it can have children, and the replay's writes stored on it reach every one of them. Edit a checkpoint, continue from it, then replay the edit, and the branch you continued reads back a write it never ran:
```
plain channel: ['in1', 'a', 'b', 'edit', 'in2', 'a', 'b']
DeltaChannel: ['in1', 'a', 'b', 'edit', 'b', 'in2', 'a', 'b']
^ the replay's b
```
And a `Command(update=...)` or `Command(goto=...)` replayed from any checkpoint stored its writes there before the run saved its fork. The branches that grew from that checkpoint replayed the update into a `DeltaChannel`, and a later replay of the same checkpoint repeated the old `Command`: the update again, in every channel, or the `goto`'s node again.
Both happen on `main`.
## Fix
Loading a checkpoint addressed by `checkpoint_id` checks, for update and fork checkpoints only, whether the thread has moved past it, with #9165 's `checkpoint_superseded`. If it has, the replay saves its fork checkpoint as it does from any other checkpoint. Subgraphs keep replaying from the edit's parent, as they did without the fork.
The run decides on the fork before it stores anything. When it forks, it keeps the `Command`'s writes in memory and applies them, and the fork snapshots the delta channels they write, so the fork carries them and nothing lands on the checkpoint the run addressed.
Cost: one extra `get_tuple` when a run addresses an update or fork checkpoint by `checkpoint_id`, such as resuming with the config `update_state` returned. A replay from an edit the thread moved past stores one more checkpoint, and a forked `Command` that writes a delta channel stores a snapshot of it.
## Limits
- A `Command(resume=...)` addressed at a checkpoint the thread moved past doesn't fork, so its run's writes still land there, and a branch that grew from that checkpoint without answering the interrupt replays them. Same on `main`. A fork would give the tasks new ids, and interrupt ids and resume-map keys are hashes of the task's namespace, which includes the task id, so a resume map built from the interrupts the caller just read would stop matching. This needs writes that record their branch (#9174 ).
## Tests
`test_delta_channel_fork.py`, on the shared checkpointer fixtures in all durabilities:
- replay from an edit the thread moved past, with and without a subgraph, sync and async, with no input and with `Command(update=...)`
- a `Command(update=...)` or `Command(goto=...)` replay of a plain checkpoint the thread moved past: the branch that grew from it reads back unchanged, and a later replay of the checkpoint doesn't repeat the `Command`
124 of the 186 cases fail on #9165 ; the exit ones pass either way.
2026-10-05 13:46:44 -04:00
Elior Nataf Lackritz and Wenchao An
456e2b1acc
fix(langgraph): keep an update_state on an older checkpoint out of its other branches ( #9165 )
...
Fixes #8551
`update_state` stores its writes on the checkpoint it addresses. A
`DeltaChannel` rebuilds its value by replaying the writes stored on its
ancestors, so when that checkpoint already has another child, the edit
shows up in that branch too. #8551 's repro, editing an earlier turn and
then reading the branch that already existed:
```
before the edit: ['in-1', 'first-out', 'in-2', 'second-out']
after the edit: ['in-1', 'first-out', 'patched', 'in-2', 'second-out']
```
The plain reducer channel in the same graph is unaffected. #8548 already
keeps the edited branch itself correct; this is the other direction.
## Fix
When `update_state` addresses a checkpoint that is not the thread's
latest, the checkpoint it creates snapshots the delta channels the
update writes, through the same snapshot #8548 adds for forks, and none
of the update's writes are stored on the addressed checkpoint, whatever
channels it writes. The edited branch reads the snapshot, and the other
branches have nothing new to replay. The addressed checkpoint stays as
it was, so a later `as_node=END` update on it doesn't take the edit in,
and the edit doesn't show as that checkpoint's task result. On `main`
both can happen in any graph, with or without a `DeltaChannel`, and a
`DeltaChannel` also takes in the other branch's writes.
"Not the latest" is one extra `get_tuple` for the thread, made when the
config names a `checkpoint_id`. It compares with the latest put, so a
checkpoint that has a child always counts. So does a leaf of an
abandoned branch, such as the old head after a fork elsewhere, where
nothing could leak; telling the two apart would mean listing the thread,
since savers have no lookup by parent. The addressed checkpoint's
pending writes can't answer it either: a finished turn that a later run
continued from has none, which is #8551 's case.
Updates on the latest checkpoint are unchanged: no snapshot, same
writes.
## Cost
Editing an older checkpoint stores one snapshot per delta channel the
update writes, the size of that channel's regular snapshot. That
includes editing a leaf of an abandoned branch, as above.
## Limits
- Threads that already leaked keep the leaked write, since it is stored
on the old checkpoint.
- The second report in #8551 , `RemoveMessage(id=REMOVE_ALL_MESSAGES)`
through `_messages_delta_reducer`, is that reducer's documented limit
and isn't changed here.
## Tests
`test_delta_channel_fork.py`, on the shared checkpointer fixtures:
- `update_state` / `aupdate_state` on an older checkpoint, both a
finished turn and one whose next node already ran there: the other
branch reads back unchanged, and continuing it stays clean
- `bulk_update_state` with two supersteps from an older checkpoint
- `update_state` with the head's `checkpoint_id` still stores no
snapshot
- `update_state(None, as_node=END)` on an edited checkpoint: an older
one leaves the edit out, also when it wrote only plain channels, and the
latest one keeps it in both channels
33 of the 59 cases fail on `main`. The rest pass either way: the head
case, the case whose next node already ran, where the saver keeps that
node's own write and drops the edit's, and `as_node=END` on the latest
checkpoint.
Thanks to @AnnaSuSu for the report, the repro, tracing the leak to the
writes landing on the addressed checkpoint, and the note that the fix
needs a snapshot on the new checkpoint first.
---------
Co-authored-by: Wenchao An <64579968+AnnaSuSu@users.noreply.github.com >
2026-10-05 17:40:47 +00:00
Elior Nataf Lackritz
1b84cb0873
fix(langgraph): keep DeltaChannel counters on every update_state path ( #9142 )
...
`update_state` saves `counters_since_delta_snapshot` on the checkpoint
it creates, except on three paths: `update_state(None, as_node=END)`,
`as_node="__input__"` and `as_node="__copy__"`. Those save their
checkpoint without it, so the next checkpoint restarts every delta
channel's counters from zero:
```
before update_state(None, END): [6, 9]
after it: (none)
after the next run: [2, 3] (with this change: [6, 10], then [8, 13])
```
The counters decide when a channel snapshots, so after any of these
updates the next snapshot comes later than `snapshot_frequency` and
reads walk further back. A thread driven only by these updates never
snapshots, so its walk keeps growing. The field's docstring says it is
absent only on threads that don't use delta channels.
## Fix
`END` and `__input__` build their checkpoint with
`create_checkpoint_plan_for_update_state_api`, the plan an update as a
node already uses, which now takes the checkpoint's `source`. The
counters advance by one superstep (`END` counts the channels its
absorbed writes touched as updated), and a channel that reaches its
bound snapshots right there. `__copy__` saves a checkpoint with the same
values on the same parent, so it keeps the copied checkpoint's counters.
## Tests
`test_delta_channel_supersteps_bound.py`, sync and async:
- each of the three paths saves the base's counters advanced by one
superstep (or unchanged for `__copy__`).
- `END` and `__input__` snapshot a channel that reaches its supersteps
bound.
All 10 fail on main.
2026-10-05 13:04:30 -04:00
Igor Soarez
8e15e0d0bc
release(langgraph): 1.2.13 ( #9205 )
...
Bumps langgraph from 1.2.12 to 1.2.13.
Stops reporting answered interrupts in `get_state()` (#9103 , fixes
#6956 ,
fixes #8579 ): latest-state reads now omit interrupts from finished
tasks,
and `Command(resume=value)` without an interrupt id raises when more
than one
interrupt is pending.
Also fixes DeltaChannel history handling: subgraph delta channels now
hydrate with the caller-resolved saver (#8538 ), an abandoned branch is
no
longer replayed into a DeltaChannel fork (#8548 ), and history is no
longer
walked for a DeltaChannel that was never written (#9141 ).
Dependency updates in `libs/langgraph`: pyjwt 2.13.0 → 2.15.1,
urllib3 2.7.0 → 2.8.0, tornado 6.5.8 → 6.5.9, notebook 7.5.6 → 7.5.7.
2026-10-05 12:13:11 -04:00
Elior Nataf Lackritz
524b320e30
fix(langgraph): don't walk history for a DeltaChannel that was never written ( #9141 )
...
A `DeltaChannel` with no version at a checkpoint was never written, so
its value is empty. `channels_from_checkpoint` still asked the saver for
its history, and with no snapshot to stop at, the walk reads every
ancestor of the thread, on every run and every `get_state`. A channel
that never gets written is common: deepagents' `files` channel when an
agent doesn't use files.
On SQLite the walk fails outright once the thread is long enough,
because stage 2 binds one variable per ancestor. With one never-written
channel on a 33,000-step thread:
```
main: get_state -> OperationalError: too many SQL variables
next run -> OperationalError: too many SQL variables
branch: get_state ok in 1 ms, next run ok
```
## Fix
Only channels that have a version at the checkpoint are walked. A
channel without one hydrates empty without asking the saver.
A version is assigned whenever a channel is written (by a task, an
input, `update_state` or a migration from a plain channel), so no
version means no write on this branch. The walk could only have found
writes this branch never applied.
Snapshotting such a channel instead would also bound the walk, but it
writes a blob for an empty value on every thread. Today
`create_checkpoint` skips any channel without a version, so even the
forced `DELTA_MAX_SUPERSTEPS_SINCE_SNAPSHOT` snapshot never lands for
it, and the walk has no bound.
## Tests
`test_delta_channel_supersteps_bound.py`: a graph whose second delta
channel is never written asks the saver only for the written channel's
history, sync and async. Both fail on main (`asked for [['a', 'b'],
['a', 'b']]`). A third test covers the case the skip must not break: a
delta channel's first write, left pending on an interrupted head before
the channel has a version, lands exactly once on resume. It passes on
main too.
JS twin: langchain-ai/langgraphjs#2927 .
2026-10-05 11:20:32 -04:00
9a0394d88b
fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork ( #8548 )
...
Fixes #8443
Fixes #9089
A checkpoint keeps the pending writes that produced its child, and
nothing records which child consumed them. When a new branch starts from
a checkpoint that already has pending writes (going back in time, or new
input on an interrupted head), the `DeltaChannel` ancestor walk replays
those writes into the new branch too. The live run is correct; only a
reload is wrong:
```
fork base: ['in-1', 'first-out']
fork returns: ['in-1', 'first-out', 'in-3', 'third-out']
reload gives: ['in-1', 'first-out', 'in-2', 'in-3', 'third-out']
^^^^^^ from the branch the fork replaced
```
Plain channels store their full value and are unaffected, so the tests
use one as the oracle.
## Fix
The first checkpoint of a new branch snapshots the delta channels its
base has pending writes for, so the walk stops inside the branch. Only
the base's own writes are branch-specific; everything above it is shared
history. A base with no pending writes has nothing to leak, so an
ordinary turn that addresses the head (as clients commonly do) stores
nothing. `bulk_update_state` takes the set from its first superstep
only: a `__copy__` is stored under the base's parent, so nothing after
it walks the base's writes. A resume that is not replaying reuses the
head's pending writes instead of rerunning their tasks, so it seals only
the loaded writes that don't go back to their task: a finished task
whose `Send` a `Command(goto=...)` replaced, or an error handler that
runs again. A plain resume stores nothing. A resume addressed by
`checkpoint_id` reruns them, so it still seals.
`put` only stores a blob for a channel whose version moved since the
last stored checkpoint, so a snapshot of one that didn't move needs a
version bump, and scheduling reads versions. `create_checkpoint`
therefore advances every `versions_seen` entry that had seen the old
version, including the interrupt tracker. Without the advance, the bump
re-fires `interrupt_before` on resume and reruns the channel's
subscribers. For each entry it advances, `SNAPSHOT_BUMPS` keeps the
version the node really read, so `update_state`'s `as_node` inference
reads `versions_seen` as if the bump never happened. A never-written
channel gets a version only for the seal; the cadence and a fresh
thread's first `update_state` skip it.
`update_state` no longer records its narrower `updated_channels` when it
snapshots; it skipped a deferred node listed in `next` on resume
(#9089 ).
The same seal fixes two `update_state` calls on one checkpoint (editing
the same message twice): both store their writes there under the same
task id, the saver keeps the first, and the second branch read back the
first one's edit.
Two things this touches were also wrong on `main`: a resumed error
handler that runs again left its stored writes on the head (an exit
reload read them twice), and `aupdate_state` on a thread seeded only by
updates raised "Ambiguous update" where `update_state` applied the
update as the input. `update_state` and `aupdate_state` now share one
`as_node` inference.
Exit durability has a separate replay bug on `main` when a resumed
checkpoint already holds writes (duplicated or reordered replay),
unrelated to forks. It's fixed in #9114 ; the resume test here marks exit
durability as a strict expected failure until then.
`tests/memory_assert.py` now compares against the checkpoint as read
back: a delta channel a step didn't write is refilled on read, which the
old comparison reported as a mutation.
Cost: 300 turns addressing the head store no snapshots, as on `main`. A
resume that reruns finished tasks seals every time. After a parallel
task finished, 30 turns of resuming with the head's `checkpoint_id`
(what Studio sends) stored 30 snapshots, 191 KB, against 12 KB of delta
writes, and a subgraph resume with a finished sibling does the same,
since a subgraph loop always counts as replaying. That seal is what
keeps a rerun task's new write from being replayed as its old one:
without it, a subgraph task that returns something different on the
rerun reads back its first result. The reruns happen on `main` too, and
stopping them would remove this cost.
276 of 464 cases in `test_delta_channel_fork.py` fail on `main` and pass
here (memory, sqlite and postgres, all durabilities). #9089 's own case
is in `test_delta_channel_update_state.py`, the cadence case in
`test_delta_channel_supersteps_bound.py`, and the `as_node` cases in
`test_pregel.py`.
## Limits
- Threads forked before this change keep their state: the ownership was
never recorded, so there is nothing to recover.
- With exit durability, a fork at a finished turn stores its writes on
the shared base, so the original branch then replays them too (`['h1',
'ai', 'h2-edited', 'ai', 'h2', 'ai']`). Same on `main`.
- `Command(update=..., goto=...)` sent to an old checkpoint stores the
update there, so the original branch replays it too. The fork itself is
correct now; the original branch is the same as on `main`.
- #8551 (the mirror case: `update_state`'s own writes leaking into the
abandoned branch) is fixed in #9165 , stacked on this PR. It builds on
this snapshot, but keys off whether the addressed checkpoint is the
thread's latest rather than on pending writes, which a finished turn
that a later run continued from doesn't have.
Thanks to @AnnaSuSu for the report, the reproduction and the snapshot
approach, and to @UditDewan for the implementation in #8476 . Both are
co-authors.
---------
Co-authored-by: AnnaSuSu <64579968+AnnaSuSu@users.noreply.github.com >
Co-authored-by: UditDewan <194863456+UditDewan@users.noreply.github.com >
2026-10-03 08:55:59 -04:00
dependabot[bot]
7dc9195e41
chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph ( #9168 )
...
Bumps [notebook](https://github.com/jupyter/notebook ) from 7.5.6 to
7.5.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/releases ">notebook's
releases</a>.</em></p>
<blockquote>
<h2>v7.5.7</h2>
<h2>7.5.7</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.6...af55f111d335315edd9e5eab472c9c1bbbb17b27 ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Pin Node to 22.x in UI tests <a
href="https://redirect.github.com/jupyter/notebook/pull/7940 ">#7940</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.5.8 <a
href="https://redirect.github.com/jupyter/notebook/pull/7939 ">#7939</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-04-30&to=2026-06-04&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-04-30..2026-06-04&type=Issues ">activity</a>)</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jupyter/notebook/blob/@jupyter-notebook/tree@7.5.7/CHANGELOG.md ">notebook's
changelog</a>.</em></p>
<blockquote>
<h2>7.5.7</h2>
<p>(<a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/application-extension@7.5.6...af55f111d335315edd9e5eab472c9c1bbbb17b27 ">Full
Changelog</a>)</p>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Pin Node to 22.x in UI tests <a
href="https://redirect.github.com/jupyter/notebook/pull/7940 ">#7940</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
<li>Update to JupyterLab v4.5.8 <a
href="https://redirect.github.com/jupyter/notebook/pull/7939 ">#7939</a>
(<a href="https://github.com/jtpio "><code>@jtpio</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports ">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyter/notebook/graphs/contributors?from=2026-04-30&to=2026-06-04&type=c ">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/jtpio "><code>@jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyter%2Fnotebook+involves%3Ajtpio+updated%3A2026-04-30..2026-06-04&type=Issues ">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyter/notebook/commit/a25fa5eda09ef85984ddafe4a5def427bf34912b "><code>a25fa5e</code></a>
Publish 7.5.7</li>
<li><a
href="https://github.com/jupyter/notebook/commit/af55f111d335315edd9e5eab472c9c1bbbb17b27 "><code>af55f11</code></a>
Update to JupyterLab v4.5.8 (<a
href="https://redirect.github.com/jupyter/notebook/issues/7939 ">#7939</a>)</li>
<li><a
href="https://github.com/jupyter/notebook/commit/1f7059106ebdd038ecd30512295e2d1f77b7d698 "><code>1f70591</code></a>
Pin Node to 22.x in UI tests to avoid Playwright install hang (<a
href="https://redirect.github.com/jupyter/notebook/issues/7940 ">#7940</a>)</li>
<li>See full diff in <a
href="https://github.com/jupyter/notebook/compare/@jupyter-notebook/tree@7.5.6...@jupyter-notebook/tree@7.5.7 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-02 14:14:46 -07:00
dependabot[bot]
1fd716c44a
chore(deps): bump virtualenv from 21.7.12 to 21.7.13 in /libs/cli ( #9167 )
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 21.7.12 to
21.7.13.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases ">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.7.13</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>👷 ci: correct a stale checkout pin comment by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3254 ">pypa/virtualenv#3254</a></li>
<li>🔧 chore: drop misc as a changelog fragment type by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3255 ">pypa/virtualenv#3255</a></li>
<li>👷 ci: scope the nushell apt key to its own repo by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3253 ">pypa/virtualenv#3253</a></li>
<li>🐛 fix(activation): stop path command injection in bash and fish by
<a href="https://github.com/gaborbernat "><code>@gaborbernat</code></a>
in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3252 ">pypa/virtualenv#3252</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13 ">https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst ">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.7.13</h1>
<ul>
<li>Fix <code>activate</code> and <code>activate.fish</code> running
commands embedded in the virtual environment path or in the
interpreter's Tcl/Tk library paths. (:issue:<code>3252</code>)</li>
</ul>
<hr />
<p>v21.7.12 (2026-09-18)</p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/0c295ff1a5f298e8e11935e3588f59f7455c1f8f "><code>0c295ff</code></a>
release 21.7.13</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 "><code>4d5a105</code></a>
🐛 fix(activation): stop path command injection in bash and fish (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3252 ">#3252</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/0525dcea21865059ffedc70054f6f982be723992 "><code>0525dce</code></a>
👷 ci: scope the nushell apt key to its own repo (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3253 ">#3253</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/aa8323a907834e9c16fb734613ce41a6d7e27260 "><code>aa8323a</code></a>
🔧 chore: drop misc as a changelog fragment type (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3255 ">#3255</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a43547765e017f3a13f029e24c6e6f73882e15bc "><code>a435477</code></a>
👷 ci: correct a stale checkout pin comment (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3254 ">#3254</a>)</li>
<li>See full diff in <a
href="https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-02 14:14:30 -07:00
3af263175f
fix(langgraph): hydrate subgraph delta channels with the caller-resolved saver ( #8538 )
...
Fixes langchain-ai/langgraph#8470
Fixes langchain-ai/langgraph#8653
Reported by @gururafiki, with a self-contained `InMemorySaver` repro and
the observation that non-delta channels in the same namespace hydrate
fine, which is what makes the failure silent. @doniyor2109 reported
#8653 , the same missing saver at the root: a graph compiled without a
checkpointer, whose saver arrives through the config, read the channel
back empty in `get_state`, `get_state_history` and `update_state`.
### The bug, in one read
One subgraph state, two channels written by the same nodes: `delta` is a
`DeltaChannel`, `plain` is an `operator.add` list. Pause the subgraph
before its second node and read it through the documented
`get_state(config, subgraphs=True).tasks[0].state`:
```
main: {'delta': [], 'plain': ['a1']}
branch: {'delta': ['a1'], 'plain': ['a1']}
```
Same call, same instant, same state object. If this were a rule about
how subgraphs manage state, both channels would be empty. Only the delta
one is, because it is the one channel type that stores nothing in
`channel_values` and has to replay its writes through a saver.
### Why only the delta channel
A subgraph has no saver of its own. It either inherits the parent's (the
default, "per-invocation") or opts in with `checkpointer=True`
("per-thread"), and in both cases the saver reaches it through
`CONFIG_KEY_CHECKPOINTER`. All four public readers resolve it from
there. `_prepare_state_snapshot` then ignored that and re-derived the
saver from `self.checkpointer`:
- per-invocation: `self.checkpointer` is `None`
- per-thread: `self.checkpointer` is `True`, and `isinstance(True,
BaseCheckpointSaver)` is `False`
So the explicit per-thread opt-in, the mode that exists to make subgraph
state readable across invocations, was broken too. With no saver the
ancestor walk never runs and the channel falls through to
`from_checkpoint(MISSING)`: an empty value, indistinguishable from never
written, raising nothing.
The saver can't be recovered inside the function: `get_state_history`
passes the checkpointer's stored config, which never carries a live
saver. The caller is the only place it exists, so the caller passes it,
as a required keyword argument.
### What stays unchanged
The two modes from the [subgraph persistence
docs](https://docs.langchain.com/oss/python/langgraph/use-subgraphs#subgraph-persistence )
where an empty read is correct are pinned by tests that pass before and
after:
- `checkpointer=False` persists nothing, so there is no subgraph
namespace to read.
- after a subgraph completes, `subgraphs=True` has no pending task to
attach state to, for every channel type alike.
### The write path loses data on disk
`bulk_update_state` / `abulk_update_state` carried the same expression.
When an update reaches the channel's snapshot cadence,
`create_checkpoint` persists a `_DeltaSnapshot` built from the empty
hydration, so `update_state` on a subgraph namespace replaces `['a1',
'b1', 'b2']` with `['manual']` permanently. At the default
`snapshot_frequency=1000` no snapshot is written and the loss stays
latent; the tests use `snapshot_frequency=2` to reach it.
`prepare_next_tasks` in `_prepare_state_snapshot` now receives the same
saver too. It was inert there (the task config falls back to
`CONFIG_KEY_CHECKPOINTER`, and `PregelTask` exposes no config), but one
expression is easier to trust than two.
### One saver lookup and namespace rule
The run loop and all six state methods now share one saver lookup
(`_resolve_checkpointer`) and one namespace rule for `checkpointer=True`
subgraphs, and the state methods find the subgraph a namespaced config
addresses through one helper (`_subgraph_for_namespace`). Before, only
`get_state` / `aget_state` stripped the task id, so `get_state_history`
and `update_state` given the subgraph task's config looked under
`name:<task_id>`, where the run never stores anything: the history came
back empty and the update was silently lost.
The namespace rule strips only the task ids: a task that calls the same
`checkpointer=True` subgraph twice stores the second call under
`<node>|1`, and `recast_checkpoint_ns` would drop that counter.
Sharing the lookup with runs also fixes two places where a state method
disagreed with a run: a `checkpointer=False` graph ignores a saver lent
through the config, so `update_state` raises "No checkpointer set"
instead of writing a checkpoint no run reads, and a `checkpointer=True`
graph used as root raises the run's `checkpointer=True cannot be used
for root graphs.` instead of an AttributeError.
`channels_from_checkpoint` now raises when a `DeltaChannel` has a
version but no stored value and no saver or config was passed, so a
caller that forgets either fails instead of reading `[]`. Keying on the
version keeps a never-written channel reading as empty.
### Verification
`tests/test_delta_channel_subgraph.py` runs against the shared
`sync_checkpointer` / `async_checkpointer` fixtures (memory, sqlite,
postgres), and every assertion compares both channels:
| surface | on main |
| -- | -- |
| `get_state` / `aget_state` on a subgraph ns | `delta: []` |
| `get_state_history` / `aget_state_history` | every snapshot `delta:
[]` |
| two levels of nesting | `delta: []` |
| `get_state(subgraphs=True)` / async, interrupted, per-invocation and
per-thread | `delta: []` |
| `update_state` / `aupdate_state` | `delta: ['manual']`, prior history
lost |
| `get_state_history` / `update_state` from a `checkpointer=True`
subgraph's task config, sync and async | no snapshots / update lost |
| `channels_from_checkpoint` with a written delta channel and no saver
or config | silent `[]` |
| `get_state` / `update_state` / `get_state_history` on a graph compiled
without a checkpointer, saver lent through the config (#8653 ), sync and
async | `delta: []` |
| `get_state` of a `checkpointer=True` subgraph's second call in one
task (`node\|1`), sync and async | the first call's state |
159 cases: 144 fail on main, all 159 pass here. The 15 that pass on main
are the two unchanged-mode controls and the never-written case.
---------
Co-authored-by: gururafiki <22777967+gururafiki@users.noreply.github.com >
Co-authored-by: Yuan Gao <119447586+DavidGao520@users.noreply.github.com >
2026-10-02 15:26:54 +00:00
Igor Soarez
e6cf9ea667
fix(langgraph): stop reporting answered interrupts in get_state ( #9103 )
...
Execution, snapshots, and resume checks interpreted the same pending
writes separately.
When one of several interrupted tasks finished after resuming,
`get_state()` still reported its answered question as pending.
Use `read_task_statuses()` across execution, state reads, and resume
checks.
An output write marks a task finished; `RESUME` alone does not, since
the
task may pause again. Record `NO_WRITES` when a resumed task completes
without output, so it isn't run again.
Latest-state reads now omit interrupts from finished tasks. History and
explicit checkpoint reads still show the last recorded interrupt per
task. A task paused at its second interrupt appears in `next` with
`result=None`. `Command(resume=value)` without an id now raises when
more than one interrupt is pending, including in a subgraph.
Threads paused before this change, where a resumed task finished without
output, still show that task as unfinished. It appears in `next` and its
answered interrupt counts as pending, so if another interrupt is also
pending, `Command(resume=value)` without an id raises. Resume these
threads by interrupt id. On SQLite and Postgres, insert-ignore can leave
an old `RESUME` value for a finished task; that task does not run again.
Fixes #6956
Fixes #8579
Thanks to @gautamvarmadatla and @russeell for reporting these.
2026-10-02 11:02:27 -04:00
157a06dda9
chore(deps-dev): bump the minor-and-patch group across 1 directory with 5 updates ( #9155 )
...
Bumps the minor-and-patch group with 5 updates in the /libs/langgraph
directory:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.1`
| `1.6.5` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [syrupy](https://github.com/syrupy-project/syrupy ) | `6.0.0` | `6.1.1`
|
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
Updates `langchain-core` from 1.6.1 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.5</h2>
<p>Changes since langchain-core==1.6.4</p>
<p>release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</p>
<h2>langchain-core==1.6.4</h2>
<p>Changes since langchain-core==1.6.3</p>
<p>release(core): 1.6.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40718 ">#40718</a>)
chore(core): deprecate chat message history (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40711 ">#40711</a>)
chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40634 ">#40634</a>)
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40574 ">#40574</a>)</p>
<h2>langchain-core==1.6.3</h2>
<p>Changes since langchain-core==1.6.2</p>
<p>release(core): 1.6.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40407 ">#40407</a>)
feat(core): Allow model name and provider tracing metadata override
based on gateway response (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40406 ">#40406</a>)
test(core): cover the deprecated <code>.text()</code> access path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40243 ">#40243</a>)
docs(core): remove stale Args/Raises entries from
FileCallbackHandler._write and ChatGeneration.set_text (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40211 ">#40211</a>)</p>
<h2>langchain-core==1.6.2</h2>
<p>Changes since langchain-core==1.6.1</p>
<p>release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40209 ">#40209</a>)
feat(openai): support async tools (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40208 ">#40208</a>)
chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40150 ">#40150</a>)
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40113 ">#40113</a>)
fix(core): avoid mutation in google-genai standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40023 ">#40023</a>)
fix(core): avoid mutation in bedrock converse standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40022 ">#40022</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0 "><code>c5ab14d</code></a>
release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f "><code>5704d9d</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40804 ">#40804</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea "><code>7622d3d</code></a>
release(openai): 1.6.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40800 ">#40800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e "><code>2dd956b</code></a>
docs(infra): fix AGENTS.md root setup guidance and package doc accuracy
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40794 ">#40794</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621 "><code>49f4b40</code></a>
fix(openai): raise on error events in stream path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40791 ">#40791</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426 "><code>19cadaa</code></a>
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2 "><code>798441e</code></a>
chore(anthropic): fix integration test cassette (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40790 ">#40790</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1 "><code>a476942</code></a>
release(openai): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40787 ">#40787</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291 "><code>46c6bdf</code></a>
release(anthropic): 1.7.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40786 ">#40786</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8 "><code>290daba</code></a>
fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40785 ">#40785</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 6.0.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.1</h2>
<blockquote>
<p><strong>Note:</strong> 6.1.0 was skipped due to a CI issue. Use
<strong>6.1.1</strong>.</p>
</blockquote>
<h3>Experimental <code>--snapshot-file-lock</code> for pytest-xdist</h3>
<p><code>--snapshot-update</code> under pytest-xdist can race when
multiple workers rewrite the same multi-entry amber (<code>.ambr</code>)
file, silently dropping snapshots (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1237 ">#1237</a>).</p>
<p>This release adds an <strong>experimental</strong> opt-in:</p>
<ul>
<li><code>--snapshot-file-lock</code> — exclusive file lock + atomic
replace around amber writes</li>
<li><code>--snapshot-file-lock-timeout</code> — max wait for the lock
(default <strong>60s</strong>)</li>
</ul>
<p>Same-machine workers only; not reliable across remote workers / NFS.
See <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">#1239</a>.</p>
<blockquote>
<p><strong>Callout for pytest-xdist users:</strong> please try
<code>--snapshot-file-lock</code> with <code>--snapshot-update</code>
and <a href="https://github.com/syrupy-project/syrupy/issues ">open an
issue</a> if you hit problems. Locking is expected to become the default
in a future minor release.</p>
</blockquote>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.1 ">v6.1.1</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.1.0 ">v6.1.0</a>
(2026-09-13)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update dependency ruff to v0.16.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1225 ">syrupy-project/syrupy#1225</a></li>
<li>chore(deps): update dependency pytest-benchmark to v5.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1226 ">syrupy-project/syrupy#1226</a></li>
<li>chore(deps): update dependency ruff to v0.16.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1227 ">syrupy-project/syrupy#1227</a></li>
<li>chore(deps): update dependency pydantic to v2.13.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1228 ">syrupy-project/syrupy#1228</a></li>
<li>chore(deps): update dependency coverage to v7.16.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1229 ">syrupy-project/syrupy#1229</a></li>
<li>chore(deps): update dependency hypothesis to v6.166.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1230 ">syrupy-project/syrupy#1230</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1231 ">syrupy-project/syrupy#1231</a></li>
<li>chore(deps): update dependency hypothesis to v6.167.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1232 ">syrupy-project/syrupy#1232</a></li>
<li>chore(deps): update actions/deploy-pages action to v5.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1234 ">syrupy-project/syrupy#1234</a></li>
<li>chore(deps): update dependency ruff to v0.16.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1235 ">syrupy-project/syrupy#1235</a></li>
<li>test: add coverage for read_snapshot_data_from_location returning
None by <a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a> in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
<li>chore(deps): update dependency hypothesis to v6.168.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1238 ">syrupy-project/syrupy#1238</a></li>
<li>fix: opt-in file lock for concurrent amber writes under xdist by <a
href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1239 ">syrupy-project/syrupy#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/shipbyaeron "><code>@shipbyaeron</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1236 ">syrupy-project/syrupy#1236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 ">https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2d251e73f1ebe47fe83ed71d835d3ae8580e8313 "><code>2d251e7</code></a>
chore(release): 6.1.1 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/9b64ec05752586c45d1097e9d25f9ee1d4e93219 "><code>9b64ec0</code></a>
chore(release): 6.1.0 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/5b4256eac8720075f25b0fa8491f75948001b983 "><code>5b4256e</code></a>
fix: opt-in file lock for concurrent amber writes under xdist (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1239 ">#1239</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/d4cb1513b5d2b1b18c3b407150db22d2d8604ddd "><code>d4cb151</code></a>
chore(deps): update dependency hypothesis to v6.168.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1238 ">#1238</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/16c4cb5b8785d89e49b8076a99f58d810e02fcce "><code>16c4cb5</code></a>
test: add coverage for read_snapshot_data_from_location returning None
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1236 ">#1236</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/2e1d3ba0d39a1d87735213a32de9dd9cdb929690 "><code>2e1d3ba</code></a>
chore(deps): update dependency ruff to v0.16.6 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1235 ">#1235</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/fcc929d4deb2302f2d37e6511015ef43a0841bc2 "><code>fcc929d</code></a>
chore(deps): update actions/deploy-pages action to v5.0.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1234 ">#1234</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4f1bad75777ecc9d916a648dd3669b2844d08f7d "><code>4f1bad7</code></a>
chore(deps): update dependency hypothesis to v6.167.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1232 ">#1232</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/24eda28579f5761cbc64713ffcee41cc73602010 "><code>24eda28</code></a>
chore(deps): update dependency hypothesis to v6.167.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1231 ">#1231</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/0d7e46f9431e07810da4ef90dbe861b85fbc8469 "><code>0d7e46f</code></a>
chore(deps): update dependency hypothesis to v6.166.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1230 ">#1230</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-01 11:57:28 -07:00
5204e60579
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-sqlite with 3 updates ( #9146 )
...
Bumps the minor-and-patch group in /libs/checkpoint-sqlite with 3
updates: [pytest-mock](https://github.com/pytest-dev/pytest-mock ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-01 11:54:00 -07:00
2053f0b176
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 2 updates ( #9145 )
...
Bumps the minor-and-patch group in /libs/checkpoint-conformance with 2
updates: [ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-01 11:53:48 -07:00
c4f55715ec
chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5 updates ( #9149 )
...
Bumps the minor-and-patch group in /libs/sdk-py with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.6.1`
| `1.6.5` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
| [starlette](https://github.com/Kludex/starlette ) | `1.6.0` | `1.7.0` |
Updates `langchain-core` from 1.6.1 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.5</h2>
<p>Changes since langchain-core==1.6.4</p>
<p>release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</p>
<h2>langchain-core==1.6.4</h2>
<p>Changes since langchain-core==1.6.3</p>
<p>release(core): 1.6.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40718 ">#40718</a>)
chore(core): deprecate chat message history (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40711 ">#40711</a>)
chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40634 ">#40634</a>)
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40574 ">#40574</a>)</p>
<h2>langchain-core==1.6.3</h2>
<p>Changes since langchain-core==1.6.2</p>
<p>release(core): 1.6.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40407 ">#40407</a>)
feat(core): Allow model name and provider tracing metadata override
based on gateway response (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40406 ">#40406</a>)
test(core): cover the deprecated <code>.text()</code> access path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40243 ">#40243</a>)
docs(core): remove stale Args/Raises entries from
FileCallbackHandler._write and ChatGeneration.set_text (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40211 ">#40211</a>)</p>
<h2>langchain-core==1.6.2</h2>
<p>Changes since langchain-core==1.6.1</p>
<p>release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40209 ">#40209</a>)
feat(openai): support async tools (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40208 ">#40208</a>)
chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40150 ">#40150</a>)
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40113 ">#40113</a>)
fix(core): avoid mutation in google-genai standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40023 ">#40023</a>)
fix(core): avoid mutation in bedrock converse standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40022 ">#40022</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0 "><code>c5ab14d</code></a>
release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f "><code>5704d9d</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40804 ">#40804</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea "><code>7622d3d</code></a>
release(openai): 1.6.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40800 ">#40800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e "><code>2dd956b</code></a>
docs(infra): fix AGENTS.md root setup guidance and package doc accuracy
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40794 ">#40794</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621 "><code>49f4b40</code></a>
fix(openai): raise on error events in stream path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40791 ">#40791</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426 "><code>19cadaa</code></a>
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2 "><code>798441e</code></a>
chore(anthropic): fix integration test cassette (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40790 ">#40790</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1 "><code>a476942</code></a>
release(openai): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40787 ">#40787</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291 "><code>46c6bdf</code></a>
release(anthropic): 1.7.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40786 ">#40786</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8 "><code>290daba</code></a>
fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40785 ">#40785</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `starlette` from 1.6.0 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases ">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.7.0</h2>
<p>This release adds experimental OpenTelemetry tracing, HTTP
<code>QUERY</code> support, and response trailers in
<code>TestClient</code>. Starlette now requires AnyIO 4.</p>
<blockquote>
<p>[!WARNING]
<code>OpenTelemetryMiddleware</code> is experimental. Its API and
emitted telemetry may change in minor releases without a deprecation
period.</p>
</blockquote>
<h2>Added</h2>
<ul>
<li>Add experimental <code>OpenTelemetryMiddleware</code> for HTTP
server spans, with URL exclusions and custom tracer providers <a
href="https://redirect.github.com/Kludex/starlette/pull/3438 ">#3438</a>,
<a
href="https://redirect.github.com/Kludex/starlette/pull/3463 ">#3463</a>,
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3520 ">#3520</a>.</li>
<li>Expose the matched route through
<code>scope["route"]</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3438 ">#3438</a>.</li>
<li>Support the <code>QUERY</code> HTTP method in
<code>HTTPEndpoint</code>, CORS, and OpenAPI 3.2 schema generation <a
href="https://redirect.github.com/Kludex/starlette/pull/3489 ">#3489</a>.</li>
<li>Capture HTTP response trailers in <code>TestClient</code> and expose
them through
<code>response.extensions["http.response.trailers"]</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3563 ">#3563</a>.</li>
<li>Support partitioned cookies in <code>SessionMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3510 ">#3510</a>.</li>
<li>Add <code>partitioned</code> to
<code>Response.delete_cookie()</code> on Python 3.14 and later <a
href="https://redirect.github.com/Kludex/starlette/pull/3376 ">#3376</a>.</li>
<li>Support IPv6 hosts in <code>TrustedHostMiddleware</code> and
<code>TestClient</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3471 ">#3471</a>.</li>
<li>Support Python 3.15 <a
href="https://redirect.github.com/Kludex/starlette/pull/3508 ">#3508</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Require <code>anyio>=4.0.0,<5</code>, dropping support for
AnyIO 3 <a
href="https://redirect.github.com/Kludex/starlette/pull/3512 ">#3512</a>.</li>
<li>Raise <code>WebSocketDisconnected</code>, a
<code>RuntimeError</code> subclass, for disconnected WebSocket
operations <a
href="https://redirect.github.com/Kludex/starlette/pull/2767 ">#2767</a>.</li>
<li>Accept <code>Collection[str]</code> in <code>CORSMiddleware</code>
configuration annotations, including sets and frozensets <a
href="https://redirect.github.com/Kludex/starlette/pull/3518 ">#3518</a>.</li>
</ul>
<h2>Fixed</h2>
<ul>
<li>Run background tasks only after the response is sent when using
<code>BaseHTTPMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3476 ">#3476</a>.</li>
<li>Return <code>400</code> for invalid multipart parser input <a
href="https://redirect.github.com/Kludex/starlette/pull/3492 ">#3492</a>.</li>
<li>Include <code>Vary: Origin</code> on all normal CORS responses and
vary preflight responses by all request headers that affect them <a
href="https://redirect.github.com/Kludex/starlette/pull/3516 ">#3516</a>
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3517 ">#3517</a>.</li>
<li>Handle malformed <code>Host</code> headers and IPv6 authorities
consistently across URL construction, host routing, and redirect
middleware <a
href="https://redirect.github.com/Kludex/starlette/pull/3472 ">#3472</a>.</li>
<li>Ignore <code>Range</code> headers when <code>FileResponse</code> has
a status other than <code>200</code>, preserving its status and full
body <a
href="https://redirect.github.com/Kludex/starlette/pull/3568 ">#3568</a>.</li>
<li>Handle standalone <code>If-None-Match: *</code> in
<code>StaticFiles</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3201 ">#3201</a>.</li>
<li>Reject WebSocket requests to <code>StaticFiles</code> without
raising an assertion error <a
href="https://redirect.github.com/Kludex/starlette/pull/3532 ">#3532</a>.</li>
<li>Persist session mutations made with <code>popitem()</code> and
<code>|=</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3436 ">#3436</a>.</li>
<li>Handle empty and absent payloads in
<code>WebSocketEndpoint.decode()</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3372 ">#3372</a>.</li>
<li>Implement <code>identity</code> on <code>SimpleUser</code> and
<code>UnauthenticatedUser</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3271 ">#3271</a>.</li>
<li>Allow <code>HTTPException</code> to use non-standard status codes
without an explicit <code>detail</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3545 ">#3545</a>.</li>
<li>Avoid deprecated AnyIO imports in <code>TestClient</code> and add
explicit imports in <code>WSGIMiddleware</code> for AnyIO 4.15
compatibility <a
href="https://redirect.github.com/Kludex/starlette/pull/3498 ">#3498</a>
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3501 ">#3501</a>.</li>
<li>Offload debug traceback rendering to a worker thread in
<code>ServerErrorMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/2858 ">#2858</a>.</li>
</ul>
<p><strong>Full changelog:</strong> <a
href="https://github.com/Kludex/starlette/compare/1.6.0...1.7.0 ">1.6.0...1.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md ">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.7.0 (September 23, 2026)</h2>
<p>This release adds experimental OpenTelemetry tracing and requires
AnyIO 4.</p>
<p>!!! warning "OpenTelemetryMiddleware is experimental"
Its API and emitted telemetry may change in minor releases without a
deprecation period
<a
href="https://redirect.github.com/Kludex/starlette/pull/3574 ">#3574</a>.</p>
<h4>Added</h4>
<ul>
<li>Add experimental <code>OpenTelemetryMiddleware</code> for HTTP
server spans, with URL exclusions and custom tracer providers <a
href="https://redirect.github.com/Kludex/starlette/pull/3438 ">#3438</a>,
<a
href="https://redirect.github.com/Kludex/starlette/pull/3463 ">#3463</a>,
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3520 ">#3520</a>.</li>
<li>Expose the matched route through
<code>scope["route"]</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3438 ">#3438</a>.</li>
<li>Support the <code>QUERY</code> HTTP method in
<code>HTTPEndpoint</code>, CORS, and OpenAPI 3.2 schema generation <a
href="https://redirect.github.com/Kludex/starlette/pull/3489 ">#3489</a>.</li>
<li>Capture HTTP response trailers in <code>TestClient</code> and expose
them through
<code>response.extensions["http.response.trailers"]</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3563 ">#3563</a>.</li>
<li>Support partitioned cookies in <code>SessionMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3510 ">#3510</a>.</li>
<li>Add <code>partitioned</code> to
<code>Response.delete_cookie()</code> on Python 3.14 and later <a
href="https://redirect.github.com/Kludex/starlette/pull/3376 ">#3376</a>.</li>
<li>Support IPv6 hosts in <code>TrustedHostMiddleware</code> and
<code>TestClient</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3471 ">#3471</a>.</li>
<li>Support Python 3.15 <a
href="https://redirect.github.com/Kludex/starlette/pull/3508 ">#3508</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Require <code>anyio>=4.0.0,<5</code>, dropping support for
AnyIO 3 <a
href="https://redirect.github.com/Kludex/starlette/pull/3512 ">#3512</a>.</li>
<li>Raise <code>WebSocketDisconnected</code>, a
<code>RuntimeError</code> subclass, for disconnected WebSocket
operations <a
href="https://redirect.github.com/Kludex/starlette/pull/2767 ">#2767</a>.</li>
<li>Accept <code>Collection[str]</code> in <code>CORSMiddleware</code>
configuration annotations, including sets and frozensets <a
href="https://redirect.github.com/Kludex/starlette/pull/3518 ">#3518</a>.</li>
</ul>
<h4>Fixed</h4>
<ul>
<li>Run background tasks only after the response is sent when using
<code>BaseHTTPMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3476 ">#3476</a>.</li>
<li>Return <code>400</code> for invalid multipart parser input <a
href="https://redirect.github.com/Kludex/starlette/pull/3492 ">#3492</a>.</li>
<li>Include <code>Vary: Origin</code> on all normal CORS responses and
vary preflight responses by all request headers that affect them <a
href="https://redirect.github.com/Kludex/starlette/pull/3516 ">#3516</a>
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3517 ">#3517</a>.</li>
<li>Handle malformed <code>Host</code> headers and IPv6 authorities
consistently across URL construction, host routing, and redirect
middleware <a
href="https://redirect.github.com/Kludex/starlette/pull/3472 ">#3472</a>.</li>
<li>Ignore <code>Range</code> headers when <code>FileResponse</code> has
a status other than <code>200</code>, preserving its status and full
body <a
href="https://redirect.github.com/Kludex/starlette/pull/3568 ">#3568</a>.</li>
<li>Handle standalone <code>If-None-Match: *</code> in
<code>StaticFiles</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3201 ">#3201</a>.</li>
<li>Reject WebSocket requests to <code>StaticFiles</code> without
raising an assertion error <a
href="https://redirect.github.com/Kludex/starlette/pull/3532 ">#3532</a>.</li>
<li>Persist session mutations made with <code>popitem()</code> and
<code>|=</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3436 ">#3436</a>.</li>
<li>Handle empty and absent payloads in
<code>WebSocketEndpoint.decode()</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3372 ">#3372</a>.</li>
<li>Implement <code>identity</code> on <code>SimpleUser</code> and
<code>UnauthenticatedUser</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3271 ">#3271</a>.</li>
<li>Allow <code>HTTPException</code> to use non-standard status codes
without an explicit <code>detail</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3545 ">#3545</a>.</li>
<li>Avoid deprecated AnyIO imports in <code>TestClient</code> and add
explicit imports in <code>WSGIMiddleware</code> for AnyIO 4.15
compatibility <a
href="https://redirect.github.com/Kludex/starlette/pull/3498 ">#3498</a>
and <a
href="https://redirect.github.com/Kludex/starlette/pull/3501 ">#3501</a>.</li>
<li>Offload debug traceback rendering to a worker thread in
<code>ServerErrorMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/2858 ">#2858</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/2269e9a08c1edd3dfdea865710f40f84c857b623 "><code>2269e9a</code></a>
Version 1.7.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3575 ">#3575</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/4fe55eb2649e74fb01472bad9a1bc54fc3495904 "><code>4fe55eb</code></a>
Preserve <code>FileResponse</code> status for range requests (<a
href="https://redirect.github.com/Kludex/starlette/issues/3568 ">#3568</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/1f08daf1627c866a4244418ea6da673d272fc8bb "><code>1f08daf</code></a>
Mark OpenTelemetryMiddleware as experimental (<a
href="https://redirect.github.com/Kludex/starlette/issues/3574 ">#3574</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/57de5fa9c2a98089a78d32d560e9b23e62560d5f "><code>57de5fa</code></a>
Support HTTP response trailers in TestClient (<a
href="https://redirect.github.com/Kludex/starlette/issues/3563 ">#3563</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/03f12b7fcf0a3e21a8da648ca0900c79472e9efe "><code>03f12b7</code></a>
Allow HTTPException to use non-standard status codes (<a
href="https://redirect.github.com/Kludex/starlette/issues/3545 ">#3545</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/76fd00f1e293990ea41555946a6b0f58901eaca1 "><code>76fd00f</code></a>
Reject <code>WebSocket</code> requests to <code>StaticFiles</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3532 ">#3532</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/f03f65c2f98c592773d691b4d309c68b83e568ef "><code>f03f65c</code></a>
docs: fix 'its not available' and 'This ensure' wording (<a
href="https://redirect.github.com/Kludex/starlette/issues/3526 ">#3526</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/485aca4e797d41849743cf73d5adcfd699695467 "><code>485aca4</code></a>
docs: the test client is built on httpx2, not httpx (<a
href="https://redirect.github.com/Kludex/starlette/issues/3525 ">#3525</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/fd662b17b9cc41dca32a03509305619643f2dd61 "><code>fd662b1</code></a>
Implement <code>identity</code> on <code>SimpleUser</code> and
<code>UnauthenticatedUser</code> (<a
href="https://redirect.github.com/Kludex/starlette/issues/3271 ">#3271</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/41db6a707f2636526847dbda0e5610e732e6b4fc "><code>41db6a7</code></a>
Stabilize CodSpeed upload buffer allocations (<a
href="https://redirect.github.com/Kludex/starlette/issues/3524 ">#3524</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/starlette/compare/1.6.0...1.7.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-10-01 11:28:27 -07:00
dependabot[bot]
b36b1d58a8
chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/langgraph ( #9160 )
...
Bumps [tornado](https://github.com/tornadoweb/tornado ) from 6.5.8 to
6.5.9.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst ">tornado's
changelog</a>.</em></p>
<blockquote>
<h1>Release notes</h1>
<p>.. toctree::
:maxdepth: 2</p>
<p>releases/v6.6.0
releases/v6.5.10
releases/v6.5.9
releases/v6.5.8
releases/v6.5.7
releases/v6.5.6
releases/v6.5.5
releases/v6.5.4
releases/v6.5.3
releases/v6.5.2
releases/v6.5.1
releases/v6.5.0
releases/v6.4.2
releases/v6.4.1
releases/v6.4.0
releases/v6.3.3
releases/v6.3.2
releases/v6.3.1
releases/v6.3.0
releases/v6.2.0
releases/v6.1.0
releases/v6.0.4
releases/v6.0.3
releases/v6.0.2
releases/v6.0.1
releases/v6.0.0
releases/v5.1.1
releases/v5.1.0
releases/v5.0.2
releases/v5.0.1
releases/v5.0.0
releases/v4.5.3
releases/v4.5.2
releases/v4.5.1
releases/v4.5.0
releases/v4.4.3
releases/v4.4.2
releases/v4.4.1
releases/v4.4.0
releases/v4.3.0
releases/v4.2.1
releases/v4.2.0
releases/v4.1.0
releases/v4.0.2</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tornadoweb/tornado/commit/75ef8b1cfa0e658aceb17c5a810ad1c74dc69bc7 "><code>75ef8b1</code></a>
Merge pull request <a
href="https://redirect.github.com/tornadoweb/tornado/issues/3719 ">#3719</a>
from bdarnell/fixes-659</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/3590cb4566d363331c294cfa63c5035ae2c32c87 "><code>3590cb4</code></a>
test: Hardcode SimpleAsyncHTTPClient in HTTP1xxLimitTestCase</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/9fc5d6d9fff435066836d165d0f1f6ebb067fb9e "><code>9fc5d6d</code></a>
test: Make tracemalloc optional in httpclient_test</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/555a2ee9a20275d6dfde879977fce58d02e7898a "><code>555a2ee</code></a>
iostream: Treat connection resets as a clean close in
read_until_close</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/3ba622f2ecb75226a8e64d4ee96b7045fc4c8a64 "><code>3ba622f</code></a>
Release notes and version bump for 6.5.9</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/41eea68aba54e8ecaafc1b777dc5c104d289a290 "><code>41eea68</code></a>
test: Fix some test issues only found by our custom tox config</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/ab1a778defaccd0dde9c1c419578e3a1777a9eeb "><code>ab1a778</code></a>
Merge remote-tracking branch
'bdarnell/claude/asynchttpclient-streaming-memor...</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 "><code>437ab5f</code></a>
web: Do not follow symlinks out of the static directory</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93 "><code>0394513</code></a>
httputil: Apply the argument count limit to query strings</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/b798f8322a15ba8b6ef725d698d1037024139714 "><code>b798f83</code></a>
http1connection: Return after reading the response that follows a
1xx</li>
<li>Additional commits viewable in <a
href="https://github.com/tornadoweb/tornado/compare/v6.5.8...v6.5.9 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 09:00:10 +00:00
dependabot[bot]
9829ef9e64
chore(deps): bump virtualenv from 21.2.4 to 21.7.12 in /libs/cli ( #9159 )
...
Bumps [virtualenv](https://github.com/pypa/virtualenv ) from 21.2.4 to
21.7.12.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases ">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.7.12</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🔧 chore(changelog): drop dead CVE-2026-24049 fragment by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3249 ">pypa/virtualenv#3249</a></li>
<li>🐛 fix(activation): escape batch quote() against injection by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3250 ">pypa/virtualenv#3250</a></li>
<li>🐛 fix(seed): verify downloaded wheel digests by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3251 ">pypa/virtualenv#3251</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12 ">https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12 </a></p>
<h2>21.7.11</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add OpenSSF Scorecard workflow by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3238 ">pypa/virtualenv#3238</a></li>
<li>Document AI-assisted contributions and licensing policy by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3239 ">pypa/virtualenv#3239</a></li>
<li>👷 ci(release): attest and sign release provenance by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3242 ">pypa/virtualenv#3242</a></li>
<li>👷 ci: harden Scorecard-scored checks in CI by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3241 ">pypa/virtualenv#3241</a></li>
<li>🐛 fix(ci): parallelize graalpy tests, recover crashed workers by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3240 ">pypa/virtualenv#3240</a></li>
<li>🐛 fix(ci): mark real-shell activation tests as slow by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3243 ">pypa/virtualenv#3243</a></li>
<li>👷 ci: run macOS jobs on macos-26 by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3244 ">pypa/virtualenv#3244</a></li>
<li>🐛 fix(activation): undo a live activation before activate.bat saves
values by <a
href="https://github.com/darrenhuai "><code>@darrenhuai</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3245 ">pypa/virtualenv#3245</a></li>
<li>🐛 fix(create): keep pyvenv.cfg values on a single line by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3247 ">pypa/virtualenv#3247</a></li>
<li>🔧 chore(test): add opt-in Atheris fuzz harness by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3246 ">pypa/virtualenv#3246</a></li>
<li>📝 docs(readme): add OpenSSF Best Practices badge by <a
href="https://github.com/gaborbernat "><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3248 ">pypa/virtualenv#3248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11 ">https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11 </a></p>
<h2>21.7.10</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🔧 chore: check spelling with typos in pre-commit by <a
href="https://github.com/even-even "><code>@even-even</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3235 ">pypa/virtualenv#3235</a></li>
<li>🐛 fix(activation): keep and restore the user's TCL_LIBRARY and
TK_LIBRARY by <a
href="https://github.com/darrenhuai "><code>@darrenhuai</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3234 ">pypa/virtualenv#3234</a></li>
<li>🐛 fix(create): skip blank and comment lines in pyvenv.cfg by <a
href="https://github.com/r3wretrhy "><code>@r3wretrhy</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3232 ">pypa/virtualenv#3232</a></li>
<li>🐛 fix(activation): restore PKG_CONFIG_PATH that was not set before
by <a href="https://github.com/darrenhuai "><code>@darrenhuai</code></a>
in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3233 ">pypa/virtualenv#3233</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/r3wretrhy "><code>@r3wretrhy</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3232 ">pypa/virtualenv#3232</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.9...21.7.10 ">https://github.com/pypa/virtualenv/compare/21.7.9...21.7.10 </a></p>
<h2>21.7.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>fix(test): EncodingWarning: 'encoding' argument not specified by <a
href="https://github.com/even-even "><code>@even-even</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3228 ">pypa/virtualenv#3228</a></li>
<li>🐛 fix(config): ignore a config file that fails to parse instead of
crashing by <a
href="https://github.com/darrenhuai "><code>@darrenhuai</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3230 ">pypa/virtualenv#3230</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst ">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.7.12</h1>
<ul>
<li>Fix <code>activate.bat</code> running arbitrary commands from a
crafted <code>--prompt</code>, <code>VIRTUALENV_PROMPT</code>, or config
file
value. (:issue:<code>3250</code>)</li>
<li>Verify a downloaded seed wheel's sha256 against PyPI before seeding
it into a virtual environment, skipped when a
custom pip index is configured. (:issue:<code>3251</code>)</li>
</ul>
<hr />
<p>v21.7.11 (2026-09-17)</p>
<hr />
<h1>Bugfixes - 21.7.11</h1>
<ul>
<li>Running <code>activate.bat</code> again before
<code>deactivate</code> no longer makes <code>deactivate</code> leave
the environment's
<code>PKG_CONFIG_PATH</code>, <code>TCL_LIBRARY</code> and
<code>TK_LIBRARY</code> behind, or lose values the user had set before
the first
activation - by :user:<code>darrenhuai</code>.
(:issue:<code>3245</code>)</li>
<li>Write <code>pyvenv.cfg</code> values on a single line, so a prompt
carrying a line boundary can no longer inject configuration.
<code>--prompt</code>, the <code>VIRTUALENV_PROMPT</code> environment
variable and the config file all set the prompt, and
<code>pyvenv.cfg</code> has no escape syntax, so a newline, a carriage
return, or any other boundary <code>str.splitlines</code>
recognizes, such as <code>U+2028</code>, started a new configuration
line. Reading the file back picked up those lines as keys,
and since the last value for a key wins, they replaced anything written
earlier, including <code>home</code>. (:issue:<code>3247</code>)</li>
</ul>
<h1>Improved Documentation - 21.7.11</h1>
<ul>
<li>Document the policy for AI-assisted contributions and the licensing
rules for dependencies. (:issue:<code>3239</code>)</li>
</ul>
<h1>Misc - 21.7.11</h1>
<ul>
<li>:issue:<code>3238</code>, :issue:<code>3240</code>,
:issue:<code>3241</code>, :issue:<code>3242</code>,
:issue:<code>3243</code>, :issue:<code>3244</code>,
:issue:<code>3246</code></li>
</ul>
<hr />
<p>v21.7.10 (2026-09-15)</p>
<hr />
<h1>Bugfixes - 21.7.10</h1>
<ul>
<li>Skip blank lines, <code>#</code> comments and lines without
<code>=</code> in <code>pyvenv.cfg</code> instead of raising
<code>ValueError</code> - by
:user:<code>r3wretrhy</code>. (:issue:<code>3232</code>)</li>
<li><code>deactivate</code> in bash, fish and PowerShell unsets
<code>PKG_CONFIG_PATH</code> when activation found it unset, instead of
keeping the environment's <code>lib/pkgconfig</code>. csh activation no
longer drops a <code>PKG_CONFIG_PATH</code> the user had set.
Activation in batch, fish, nushell and PowerShell no longer adds a
trailing separator when <code>PKG_CONFIG_PATH</code> is
unset, and PowerShell and nushell build the value with the host's path
separators - by :user:<code>darrenhuai</code>.
(:issue:<code>3233</code>)</li>
<li>Activation in bash, csh, fish and PowerShell keeps the user's
<code>TCL_LIBRARY</code> and <code>TK_LIBRARY</code>, and
<code>deactivate</code>
restores them. csh and PowerShell removed both variables on every
activation, fish did so when the interpreter has</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/9666b42afc8d6103e765d77958d7bae782f5406e "><code>9666b42</code></a>
release 21.7.12</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d "><code>a01ed3e</code></a>
🐛 fix(seed): verify downloaded wheel digests (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3251 ">#3251</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 "><code>d721ff1</code></a>
🐛 fix(activation): escape batch quote() against injection (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3250 ">#3250</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/087a2ef8bd3aa15b562a3558b1068f603e50f77a "><code>087a2ef</code></a>
🔧 chore(changelog): drop dead CVE-2026-24049 fragment (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3249 ">#3249</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/73e352ae02bfa52ffc0e307b04f1b6a7168c4eb0 "><code>73e352a</code></a>
release 21.7.11</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/68ee5a3f27ca44912af9bd73c4c87e41978a8c08 "><code>68ee5a3</code></a>
📝 docs(readme): add OpenSSF Best Practices badge (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3248 ">#3248</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/787d1c9a0843310200f37861e6b2744a7d1e5364 "><code>787d1c9</code></a>
🔧 chore(test): add opt-in Atheris fuzz harness (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3246 ">#3246</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 "><code>a30f995</code></a>
🐛 fix(create): keep pyvenv.cfg values on a single line (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3247 ">#3247</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/469dd28e659f7cd3e7d8cdb3f1245c125d32e817 "><code>469dd28</code></a>
🐛 fix(activation): undo a live activation before activate.bat saves
values (#...</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a045a14c76dcb71d1811fe57aa6c5f4fad2357cd "><code>a045a14</code></a>
👷 ci: run macOS jobs on macos-26 (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3244 ">#3244</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/virtualenv/compare/21.2.4...21.7.12 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 08:59:43 +00:00
dependabot[bot]
f6e9ace639
chore(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 in the minor-and-patch group ( #9144 )
...
Bumps the minor-and-patch group with 1 update:
[actions/deploy-pages](https://github.com/actions/deploy-pages ).
Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/deploy-pages/releases ">actions/deploy-pages's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h1>Changelog</h1>
<ul>
<li>Add backoff and jitter to deployment polling <a
href="https://github.com/yoannchaudet "><code>@yoannchaudet</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/444 ">#444</a>)</li>
<li>Improve deployment request test coverage <a
href="https://github.com/adwitiyagoyal "><code>@adwitiyagoyal</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/440 ">#440</a>)</li>
</ul>
<hr />
<p>See details of <a
href="https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1 ">all
code changes</a> since previous release.</p>
<p>⚠️ For use with products other than GitHub.com, such as GitHub
Enterprise Server, please consult the <a
href="https://github.com/actions/deploy-pages/#compatibility ">compatibility
table</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346 "><code>368f825</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/444 ">#444</a>
from actions/yoannchaudet-deployment-polling-backoff</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094 "><code>7e97763</code></a>
Validate deployment polling intervals</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45 "><code>0143e11</code></a>
Add backoff and jitter to deployment polling</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499 "><code>5e98f10</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/440 ">#440</a>
from actions/user/adwitiya</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc "><code>8b0625a</code></a>
Improve deployment request test coverage</li>
<li>See full diff in <a
href="https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:52:22 -07:00
dependabot[bot]
b1765f3d0f
chore(deps): bump the minor-and-patch group in /libs/checkpoint-postgres with 6 updates ( #9147 )
...
Bumps the minor-and-patch group in /libs/checkpoint-postgres with 6
updates:
| Package | From | To |
| --- | --- | --- |
| [psycopg](https://github.com/psycopg/psycopg ) | `3.3.4` | `3.3.6` |
| [psycopg-pool](https://github.com/psycopg/psycopg ) | `3.3.1` | `3.3.3`
|
| [anyio](https://github.com/agronholm/anyio ) | `4.14.2` | `4.15.1` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
Updates `psycopg` from 3.3.4 to 3.3.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst ">psycopg's
changelog</a>.</em></p>
<blockquote>
<p>.. currentmodule:: psycopg</p>
<p>.. index::
single: Release notes
single: News</p>
<h1><code>psycopg</code> release notes</h1>
<h2>Future releases</h2>
<p>Psycopg 3.3.7 (unreleased)
^^^^^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix segfault fetching arrays of strings or timestamps after closing
the
connection
(🎫 <code>[#1428 ](https://github.com/psycopg/psycopg/issues/1428 )</code>).</li>
</ul>
<h2>Current release</h2>
<p>Psycopg 3.3.6
^^^^^^^^^^^^^</p>
<ul>
<li>Add support for Python 3.15
(🎫 <code>[#1245 ](https://github.com/psycopg/psycopg/issues/1245 )</code>).</li>
<li>Improve performance of async queries by reducing the overhead of the
<code>!wait_async()</code> function
(🎫 <code>[#1331 ](https://github.com/psycopg/psycopg/issues/1331 )</code>).</li>
<li>Don't wait forever for a query to terminate after interrupting it,
for
instance if the server is unresponsive. The fix requires libpq 17 or
newer
(🎫 <code>[#1371 ](https://github.com/psycopg/psycopg/issues/1371 )</code>).</li>
<li>Cancel a running query upon receiving <code>!SystemExit</code>
(🎫 <code>[#1384 ](https://github.com/psycopg/psycopg/issues/1384 )</code>).</li>
<li>Report <code>!None</code> instead of <code>65535</code> as the
<code>Column.precision</code> of an
:sql:<code>interval</code> column declared with a fields restriction and
no explicit
precision, such as e.g. :sql:<code>interval day to second</code>
(🎫 <code>[#1397 ](https://github.com/psycopg/psycopg/issues/1397 )</code>).</li>
<li>Fix dumping of nested subclasses of lists as arrays
(🎫 <code>[#1398 ](https://github.com/psycopg/psycopg/issues/1398 )</code>).</li>
<li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code>
(🎫 <code>[#1408 ](https://github.com/psycopg/psycopg/issues/1408 )</code>).</li>
<li>Better guards dumping large Python <code>!int</code> to binary
numeric
(🎫 <code>[#1414 ](https://github.com/psycopg/psycopg/issues/1414 )</code>).</li>
</ul>
<p>Psycopg 3.3.5
^^^^^^^^^^^^^</p>
<ul>
<li>Discard prepared statements upon :sql:<code>ALTER *</code> or
<code>DISCARD *</code>
(🎫 <code>[#1307 ](https://github.com/psycopg/psycopg/issues/1307 )</code>).</li>
<li>Fix <code>!ProgrammingError</code> when dumping
non-<code>!None</code> values with
no <code>!NoneType</code> dumper registered in python implementation
(🎫 <code>[#1325 ](https://github.com/psycopg/psycopg/issues/1325 )</code>).</li>
<li>Fix <code>!wait_selector</code> wait function to not raise
<code>!KeyError</code>
(🎫 <code>[#1327 ](https://github.com/psycopg/psycopg/issues/1327 )</code>).</li>
<li>Fix <code>!DataError</code> messages leaking the literal
<code>{...}</code> placeholder instead</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psycopg/psycopg/commit/a67654d1e7afbf9b3a619557838f62de1c790e7c "><code>a67654d</code></a>
chore: bump psycopg package version to 3.3.6</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/443814b3b111ac678a39fd523c1a826266fb69b5 "><code>443814b</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1416 ">#1416</a>
from dvarrazzo/wait-async-perf</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/42966e9ebbda3b9c69b15c5588543c15f2aae5dd "><code>42966e9</code></a>
test: add helpful comments to some tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/5e8797f0c8003d8cd12a1e5c13f05fbb94c1c1d2 "><code>5e8797f</code></a>
test: add reasonable connect_timeout to most tests</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/c81ba62442dfbd69e207d6914e6ae2aa27e56886 "><code>c81ba62</code></a>
perf: reduce the overhead of wait_async()</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/d2bbfe4e2b1e36a20e72a18097f35a3db27296e3 "><code>d2bbfe4</code></a>
refactor: use get_running_loop() in the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b1484a550e01c88fda077099678f0abb9217ecb "><code>2b1484a</code></a>
test: add a script to measure the async wait functions</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/573cf4aa70d8fdefc9d5f3eb69d5419cd6d3cd51 "><code>573cf4a</code></a>
test: fix incorrect wait timing test</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/2b68990874175b8d97269218d4963b2d5c8656f3 "><code>2b68990</code></a>
refactor: drop leftovers of waiting with inf interval in
wait_conn_async</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/60765dd8fc7d8df03cd75efcff485bfb3c83a0ed "><code>60765dd</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1414 ">#1414</a>
from dvarrazzo/fix-decimal-overflow</li>
<li>Additional commits viewable in <a
href="https://github.com/psycopg/psycopg/compare/3.3.4...3.3.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `psycopg-pool` from 3.3.1 to 3.3.3
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst ">psycopg-pool's
changelog</a>.</em></p>
<blockquote>
<p>.. currentmodule:: psycopg</p>
<p>.. index::
single: Release notes
single: News</p>
<h1><code>psycopg</code> release notes</h1>
<h2>Future releases</h2>
<p>Psycopg 3.3.7 (unreleased)
^^^^^^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li>Fix segfault fetching arrays of strings or timestamps after closing
the
connection
(🎫 <code>[#1428 ](https://github.com/psycopg/psycopg/issues/1428 )</code>).</li>
</ul>
<h2>Current release</h2>
<p>Psycopg 3.3.6
^^^^^^^^^^^^^</p>
<ul>
<li>Add support for Python 3.15
(🎫 <code>[#1245 ](https://github.com/psycopg/psycopg/issues/1245 )</code>).</li>
<li>Improve performance of async queries by reducing the overhead of the
<code>!wait_async()</code> function
(🎫 <code>[#1331 ](https://github.com/psycopg/psycopg/issues/1331 )</code>).</li>
<li>Don't wait forever for a query to terminate after interrupting it,
for
instance if the server is unresponsive. The fix requires libpq 17 or
newer
(🎫 <code>[#1371 ](https://github.com/psycopg/psycopg/issues/1371 )</code>).</li>
<li>Cancel a running query upon receiving <code>!SystemExit</code>
(🎫 <code>[#1384 ](https://github.com/psycopg/psycopg/issues/1384 )</code>).</li>
<li>Report <code>!None</code> instead of <code>65535</code> as the
<code>Column.precision</code> of an
:sql:<code>interval</code> column declared with a fields restriction and
no explicit
precision, such as e.g. :sql:<code>interval day to second</code>
(🎫 <code>[#1397 ](https://github.com/psycopg/psycopg/issues/1397 )</code>).</li>
<li>Fix dumping of nested subclasses of lists as arrays
(🎫 <code>[#1398 ](https://github.com/psycopg/psycopg/issues/1398 )</code>).</li>
<li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code>
(🎫 <code>[#1408 ](https://github.com/psycopg/psycopg/issues/1408 )</code>).</li>
<li>Better guards dumping large Python <code>!int</code> to binary
numeric
(🎫 <code>[#1414 ](https://github.com/psycopg/psycopg/issues/1414 )</code>).</li>
</ul>
<p>Psycopg 3.3.5
^^^^^^^^^^^^^</p>
<ul>
<li>Discard prepared statements upon :sql:<code>ALTER *</code> or
<code>DISCARD *</code>
(🎫 <code>[#1307 ](https://github.com/psycopg/psycopg/issues/1307 )</code>).</li>
<li>Fix <code>!ProgrammingError</code> when dumping
non-<code>!None</code> values with
no <code>!NoneType</code> dumper registered in python implementation
(🎫 <code>[#1325 ](https://github.com/psycopg/psycopg/issues/1325 )</code>).</li>
<li>Fix <code>!wait_selector</code> wait function to not raise
<code>!KeyError</code>
(🎫 <code>[#1327 ](https://github.com/psycopg/psycopg/issues/1327 )</code>).</li>
<li>Fix <code>!DataError</code> messages leaking the literal
<code>{...}</code> placeholder instead</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psycopg/psycopg/commit/1a8f65a371da3c691111cd4a81141f2cb698eafa "><code>1a8f65a</code></a>
chore: bump psycopg package version to 3.3.3</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/db3c43584320ab5d97e49378e5c9dc09a560b031 "><code>db3c435</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1260 ">#1260</a>
from ggevay/sync-error-fix</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/0237586c415ece15102742f5941874c29fb1221c "><code>0237586</code></a>
Fix ValueError when server sends ErrorResponse during Sync after
Parse</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/cb97ef7063520cb8a0cb5236bb9791f8dc4cc454 "><code>cb97ef7</code></a>
docs: fix typos</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/09c89180f94606dc70475ed863e135f021a11038 "><code>09c8918</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1256 ">#1256</a>
from veeceey/fix/tstrings-error-msg-and-docs-improve...</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/9e74d9646cc3fcbb9d8940182dcdb41119c3fda7 "><code>9e74d96</code></a>
fix: fix error message incorrectly generated by Claude AI</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/0db9d8bb76c48e70dffd48776406fd3ffdc89b5a "><code>0db9d8b</code></a>
fix: correct typo in tstrings error message and fix sql.rst docs</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/86a0e1b2bbf30c564c59bf3497d499e2f220ce0f "><code>86a0e1b</code></a>
chore(deps): bump pypa/cibuildwheel in the actions group</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/f5d90fa2a7836c1268c1d43d0d77c431434ad191 "><code>f5d90fa</code></a>
Merge pull request <a
href="https://redirect.github.com/psycopg/psycopg/issues/1233 ">#1233</a>
from lysnikolaou/pgconn-critical-section</li>
<li><a
href="https://github.com/psycopg/psycopg/commit/d7dc6c7cacc2832fffa0d7e607b5fc171424571d "><code>d7dc6c7</code></a>
Merge critical section and nogil blocks into one context manager</li>
<li>Additional commits viewable in <a
href="https://github.com/psycopg/psycopg/compare/3.3.1...3.3.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `anyio` from 4.14.2 to 4.15.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.15.1</h2>
<ul>
<li>Implemented a compatibility fix for supporting direct access of
<code>anyio.*</code> submodules from the main package even when those
submodules were not directly imported first (<!-- raw HTML omitted --><a
href="https://redirect.github.com/agronholm/anyio/issues/1311 ">#1311</a>
<<a
href="https://redirect.github.com/agronholm/anyio/issues/1311%5C%3E ">agronholm/anyio#1311</a><!--
raw HTML omitted -->)</li>
</ul>
<h2>4.15.0</h2>
<ul>
<li>
<p>Added support for the newer keyword-only arguments on
<code>anyio.Path</code> methods to match the standard library
<code>pathlib.Path</code>:</p>
<ul>
<li><code>follow_symlinks</code> on <code>exists()</code> (Python
3.12+)</li>
<li><code>follow_symlinks</code> on <code>is_dir()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>is_file()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>owner()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>group()</code> (Python
3.13+)</li>
<li><code>newline</code> on <code>read_text()</code> (Python 3.13+)</li>
</ul>
<p>(<a
href="https://redirect.github.com/agronholm/anyio/pull/1286 ">#1286</a>,
<a
href="https://redirect.github.com/agronholm/anyio/pull/1293 ">#1293</a>;
PR by <a
href="https://github.com/jaideeppyne "><code>@jaideeppyne</code></a>)</p>
</li>
<li>
<p>Added <code>amap</code>, <code>gather</code>, and
<code>as_completed</code> utility functions to simplify common patterns
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1173 ">#1173</a>;
PR by <a
href="https://github.com/Graeme22 "><code>@Graeme22</code></a>)</p>
</li>
<li>
<p>Added <code>--anyio-mode</code> command-line option as an alternative
to the <code>anyio_mode</code> ini setting, and fix the pytest plugin's
auto mode detection to recognize the mode when set via either
mechanism(e.g: <code>pytest_asyncio</code>). (<a
href="https://redirect.github.com/agronholm/anyio/pull/1242 ">#1242</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Added the <code>anyio.Future</code> synchronization primitive which
behaves similar to <code>asyncio.Future</code>, allowing tasks to wait
for a value (or exception) from another task (<a
href="https://redirect.github.com/agronholm/anyio/pull/1146 ">#1146</a>;
PR by <a
href="https://github.com/Vizonex "><code>@Vizonex</code></a>)</p>
</li>
<li>
<p>Added guidance for managing multiple memory object stream producers
and consumers with cloned streams (<a
href="https://redirect.github.com/agronholm/anyio/issues/330 ">#330</a>;
PR by <a
href="https://github.com/nightcityblade "><code>@nightcityblade</code></a>)</p>
</li>
<li>
<p>Added <code>StapledObjectStream.send_nowait()</code> that delegates
to the underlying <code>ObjectSendStream</code>, if it implements it (<a
href="https://redirect.github.com/agronholm/anyio/pull/1241 ">#1241</a>;
PR by <a
href="https://github.com/davidbrochart "><code>@davidbrochart</code></a>)</p>
</li>
<li>
<p>Added the <code>move_on_at()</code> and <code>fail_at()</code>
functions to complement <code>move_on_after()</code> and
<code>fail_after()</code></p>
</li>
<li>
<p>Changed the default name for a task spawned with
<code>TaskGroup.create_task(func())</code> to match the default task
name for the analogous task spawned with
<code>TaskGroup.start_soon(func)</code> or
<code>TaskGroup.start(func)</code> in more situations. Previously, the
default name of a <code>TaskGroup.create_task</code> task never included
the module name. (The default name for a task spawned with
<code>TaskGroup.start_soon</code> or <code>TaskGroup.start</code>
typically includes the module name.) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1234 ">#1234</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed the <code>anyio</code> and <code>anyio.abc</code> modules to
lazily (much like <code>810</code>) import the necessary submodules.
This is done by parsing the AST of the module and building a lookup
table from the <code>if TYPE_CHECKING:</code> block. A fallback mode has
been provided for installations where the source code is unavailable
(e.g. PyInstaller). (<a
href="https://redirect.github.com/agronholm/anyio/pull/1169 ">#1169</a>)</p>
</li>
<li>
<p>Fixed free-threading compatibility issues arising from the fact that
on Python 3.14 free-threading builds, newly created threads inherit the
current context by default, causing AnyIO to behave erroneously in
relation to <code>start_blocking_portal()</code> and
<code>anyio.to_thread.run_sync()</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1224 ">#1224</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Fixed <code>SpooledTemporaryFile.readinto()</code> and
<code>readinto1()</code> reading twice before rollover, so the
destination buffer was overwritten by the second read and the file
position advanced twice, silently losing data (<a
href="https://redirect.github.com/agronholm/anyio/pull/1215 ">#1215</a>;
PR by <a
href="https://github.com/c-tonneslan "><code>@c-tonneslan</code></a>)</p>
</li>
<li>
<p>Added a <code>reason</code> parameter to <code>fail_after</code> (and
the new <code>fail_at</code>) allowing for added exception context when
raising <code>TimeoutError</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1227 ">#1227</a>;
PR by <a
href="https://github.com/Graeme22 "><code>@Graeme22</code></a>)</p>
</li>
<li>
<p>Fixed the default <code>TaskHandle.name</code> missing part of the
task name for tasks started with <code>TaskGroup.start</code> on Trio
(<a
href="https://redirect.github.com/agronholm/anyio/issues/1231 ">#1231</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.run</code> leaking, or at least, delaying
collection of loop and root_task due to the root task being cached in a
<code>RunVar</code>. (<a
href="https://redirect.github.com/agronholm/anyio/issues/1203 ">#1203</a>;
PR by <a
href="https://github.com/tapetersen "><code>@tapetersen</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.Path.with_stem()</code> silently producing a wrong
path (e.g. <code>Path(".txt")</code>) instead of raising
<code>ValueError</code> when given an empty stem on a path with a
non-empty suffix, unlike <code>pathlib.PurePath.with_stem</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1200 ">#1200</a>;
PR by <a
href="https://github.com/Sanjays2402 "><code>@Sanjays2402</code></a>)</p>
</li>
<li>
<p>Fixed <code>UNIXSocketStream.aclose()</code> raising
<code>asyncio.InvalidStateError</code> when a concurrent receive or send
operation had just been cancelled on the asyncio backend (<a
href="https://redirect.github.com/agronholm/anyio/issues/1267 ">#1267</a>;
PR by <a
href="https://github.com/alloutflo "><code>@alloutflo</code></a>)</p>
</li>
<li>
<p>Fixed the pytest plugin importing the deprecated
<code>_pytest.python.CallSpec2</code> alias, which triggers
<code>PytestRemovedIn10Warning</code> on <code>pytest>=9.2</code> and
crashes pytest at startup when <code>filterwarnings = error</code> is
configured (<a
href="https://redirect.github.com/agronholm/anyio/issues/1271 ">#1271</a>;
PR by <a
href="https://github.com/matthewfeickert "><code>@matthewfeickert</code></a>)</p>
</li>
<li>
<p>Fixed an asyncio worker thread race that could raise
<code>RuntimeError</code> when the event loop closed between checking
its state and scheduling the worker result (<a
href="https://redirect.github.com/agronholm/anyio/issues/1265 ">#1265</a>;
PR by <a
href="https://github.com/hansu650 "><code>@hansu650</code></a>)</p>
</li>
<li>
<p>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens when <code>total_tokens</code> was raised while the
limiter was over-subscribed (<a
href="https://redirect.github.com/agronholm/anyio/pull/1223 ">#1223</a>;
PR by <a
href="https://github.com/zelinewang "><code>@zelinewang</code></a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/ffcd1542cd6d127980205f90a0100078849dd703 "><code>ffcd154</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/0ecf5ed98d294242509b043ebd1a0843e52d892f "><code>0ecf5ed</code></a>
Added a workaround for third party code accessing unimported submodules
(<a
href="https://redirect.github.com/agronholm/anyio/issues/1309 ">#1309</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/928366259543412a2deb1e2ba09ea45ffa92ef4f "><code>9283662</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/d137692a90f76e4f71605e32ea5ca94cab3a539d "><code>d137692</code></a>
Improved the instructions for AI agents</li>
<li><a
href="https://github.com/agronholm/anyio/commit/033fc52b8fa8e90c5d0ef24b10b3860e974a6265 "><code>033fc52</code></a>
Shield TemporaryDirectory cleanup from cancellation (<a
href="https://redirect.github.com/agronholm/anyio/issues/1304 ">#1304</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/942e9a6552cc10b5aaa779d84bfc8e2c3d5fcffc "><code>942e9a6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/agronholm/anyio/issues/1305 ">#1305</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/b825c3be7cb4ca1a8000b8065d4e147843deb704 "><code>b825c3b</code></a>
Fixed pyproject.toml changes not triggering the test suite</li>
<li><a
href="https://github.com/agronholm/anyio/commit/9727dc504681e2986b5bc285de9571fb467539af "><code>9727dc5</code></a>
Fixed start inconsistencies between trio and asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1198 ">#1198</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/b05fe6d160a640355c201363cab286a7d2581da8 "><code>b05fe6d</code></a>
Fixed wrong type in move_on_after (<a
href="https://redirect.github.com/agronholm/anyio/issues/1297 ">#1297</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44d0c93cc20079acbf38ba4dbed5ab9df323f153 "><code>44d0c93</code></a>
Fixed asyncio task group coroutine cleanup (<a
href="https://redirect.github.com/agronholm/anyio/issues/1275 ">#1275</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.14.2...4.15.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:52:12 -07:00
dependabot[bot]
3a2501e8c5
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 updates ( #9148 )
...
Bumps the minor-and-patch group in /libs/checkpoint with 4 updates:
[langchain-core](https://github.com/langchain-ai/langchain ),
[pytest-mock](https://github.com/pytest-dev/pytest-mock ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `langchain-core` from 1.6.1 to 1.6.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.5</h2>
<p>Changes since langchain-core==1.6.4</p>
<p>release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</p>
<h2>langchain-core==1.6.4</h2>
<p>Changes since langchain-core==1.6.3</p>
<p>release(core): 1.6.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40718 ">#40718</a>)
chore(core): deprecate chat message history (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40711 ">#40711</a>)
chore(deps): bump anyio from 4.12.0 to 4.14.2 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40634 ">#40634</a>)
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40574 ">#40574</a>)</p>
<h2>langchain-core==1.6.3</h2>
<p>Changes since langchain-core==1.6.2</p>
<p>release(core): 1.6.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40407 ">#40407</a>)
feat(core): Allow model name and provider tracing metadata override
based on gateway response (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40406 ">#40406</a>)
test(core): cover the deprecated <code>.text()</code> access path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40243 ">#40243</a>)
docs(core): remove stale Args/Raises entries from
FileCallbackHandler._write and ChatGeneration.set_text (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40211 ">#40211</a>)</p>
<h2>langchain-core==1.6.2</h2>
<p>Changes since langchain-core==1.6.1</p>
<p>release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40209 ">#40209</a>)
feat(openai): support async tools (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40208 ">#40208</a>)
chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40150 ">#40150</a>)
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40113 ">#40113</a>)
fix(core): avoid mutation in google-genai standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40023 ">#40023</a>)
fix(core): avoid mutation in bedrock converse standard content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40022 ">#40022</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0 "><code>c5ab14d</code></a>
release(core): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40816 ">#40816</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f "><code>5704d9d</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40804 ">#40804</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea "><code>7622d3d</code></a>
release(openai): 1.6.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40800 ">#40800</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e "><code>2dd956b</code></a>
docs(infra): fix AGENTS.md root setup guidance and package doc accuracy
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40794 ">#40794</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621 "><code>49f4b40</code></a>
fix(openai): raise on error events in stream path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40791 ">#40791</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426 "><code>19cadaa</code></a>
fix(core): abbreviate long tool IDs in XML buffer strings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40792 ">#40792</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2 "><code>798441e</code></a>
chore(anthropic): fix integration test cassette (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40790 ">#40790</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1 "><code>a476942</code></a>
release(openai): 1.6.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40787 ">#40787</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291 "><code>46c6bdf</code></a>
release(anthropic): 1.7.4 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40786 ">#40786</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8 "><code>290daba</code></a>
fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/40785 ">#40785</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:52:01 -07:00
dependabot[bot]
3474bbff29
chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example with 8 updates ( #9151 )
...
Bumps the minor-and-patch group in /libs/cli/js-monorepo-example with 8
updates:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo ) | `2.10.12` | `2.11.5` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc ) | `3.3.6` |
`3.3.7` |
| [eslint](https://github.com/eslint/eslint ) | `10.9.1` | `10.11.0` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.68.0` | `8.70.1` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.68.0` | `8.70.1` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.6` | `3.9.9` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.9` | `1.2.13` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.13` | `1.4.18` |
Updates `turbo` from 2.10.12 to 2.11.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases ">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.11.5</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.11.4 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14231 ">vercel/turborepo#14231</a></li>
<li>test: Move Python opt-in hint into filter contracts by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14228 ">vercel/turborepo#14228</a></li>
<li>test: Move dependency-output summary assertion into contract by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14230 ">vercel/turborepo#14230</a></li>
<li>test: Move dependency-output selection and validation cases to
engine contracts by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14232 ">vercel/turborepo#14232</a></li>
<li>test: Move Cargo exclude-only scope coverage by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14238 ">vercel/turborepo#14238</a></li>
<li>test: Move Cargo cache-authority cases to contracts by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14240 ">vercel/turborepo#14240</a></li>
<li>test: Move JIT dependency graph scenario into engine contract by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14235 ">vercel/turborepo#14235</a></li>
<li>test: Move dependency-output hash cases into task-hash contracts by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14233 ">vercel/turborepo#14233</a></li>
<li>test: Move Cargo task-filter cases into crate contracts by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14239 ">vercel/turborepo#14239</a></li>
<li>test: Move JIT input hash timing cases into task-hash contracts by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14234 ">vercel/turborepo#14234</a></li>
<li>test: Move package input normalization cases into engine contracts
by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14236 ">vercel/turborepo#14236</a></li>
<li>test: Move structured startup and JIT input cases into contracts by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14237 ">vercel/turborepo#14237</a></li>
<li>fix: Back off remote artifact requests during outages by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14222 ">vercel/turborepo#14222</a></li>
<li>chore: Release Turborepo 2.11.5-canary.1 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14245 ">vercel/turborepo#14245</a></li>
<li>test: Make new-package lockfile filter deterministic by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14241 ">vercel/turborepo#14241</a></li>
<li>test: Trim redundant Go cache builds by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14242 ">vercel/turborepo#14242</a></li>
<li>test: Reduce Go versioned-name test matrix by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14243 ">vercel/turborepo#14243</a></li>
<li>test: Move Go binary checks into contracts by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14246 ">vercel/turborepo#14246</a></li>
<li>test: Consolidate Go format smokes by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14244 ">vercel/turborepo#14244</a></li>
<li>test: Reuse Cargo build artifacts safely by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14247 ">vercel/turborepo#14247</a></li>
<li>test: Separate prune planning matrix from buildability smoke by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14248 ">vercel/turborepo#14248</a></li>
<li>feat: Bundle docs in <code>turbo</code> npm package by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14108 ">vercel/turborepo#14108</a></li>
<li>chore: Release Turborepo 2.11.5-canary.2 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/14249 ">vercel/turborepo#14249</a></li>
<li>fix: Stabilize pnpm per-workspace lockfile hashes by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14253 ">vercel/turborepo#14253</a></li>
<li>chore: Upgrade factory Next.js to 16.3.3 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14254 ">vercel/turborepo#14254</a></li>
<li>fix: Update js-yaml to address CVE-2026-84375 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14255 ">vercel/turborepo#14255</a></li>
<li>chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14256 ">vercel/turborepo#14256</a></li>
<li>fix: Remove unmaintained proc-macro-error2 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14257 ">vercel/turborepo#14257</a></li>
<li>refactor: Replace clap in production CLIs with usage-rs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14259 ">vercel/turborepo#14259</a></li>
<li>chore: Remove tiny-gradient dependency by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14260 ">vercel/turborepo#14260</a></li>
<li>refactor: Replace human-panic with local crash reporting by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14261 ">vercel/turborepo#14261</a></li>
<li>chore: Remove unused struct_iterable dependency by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14258 ">vercel/turborepo#14258</a></li>
<li>fix: Sign complete on-disk artifacts after local cache writes by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14265 ">vercel/turborepo#14265</a></li>
<li>chore: Remove <code>derive_setters</code> dependency by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14266 ">vercel/turborepo#14266</a></li>
<li>chore: Remove port_scanner dependency by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14267 ">vercel/turborepo#14267</a></li>
<li>chore: Remove unused Rust dependency declarations by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14268 ">vercel/turborepo#14268</a></li>
<li>refactor: Remove unused public Rust APIs by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14269 ">vercel/turborepo#14269</a></li>
<li>refactor: Use workspace Rust edition across crates by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14270 ">vercel/turborepo#14270</a></li>
<li>chore: Clean up Rust Clippy exceptions by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14271 ">vercel/turborepo#14271</a></li>
<li>refactor: Group task-hash and uv generation context by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14279 ">vercel/turborepo#14279</a></li>
<li>refactor: Remove unused global hash wrapper by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14281 ">vercel/turborepo#14281</a></li>
<li>refactor: Remove unused file-hash telemetry argument by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14282 ">vercel/turborepo#14282</a></li>
<li>refactor: Remove dead CLI code and crate-wide allowance by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14283 ">vercel/turborepo#14283</a></li>
<li>refactor: Remove dead Microfrontends config code by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14284 ">vercel/turborepo#14284</a></li>
<li>refactor: Remove unused UI task types and dead-code allowance by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/14286 ">vercel/turborepo#14286</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/8492b42667210270f4169f0df8c0edf725ff2f41 "><code>8492b42</code></a>
publish 2.11.5 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a50ee6536eac2f7f3168cc38087ee7d8397fc0e9 "><code>a50ee65</code></a>
chore: Release Turborepo 2.11.5-canary.5 (<a
href="https://redirect.github.com/vercel/turborepo/issues/14328 ">#14328</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c9602f339008964f8dfaf6329491c374cf2f0a60 "><code>c9602f3</code></a>
fix: Pass repository to release asset commands (<a
href="https://redirect.github.com/vercel/turborepo/issues/14327 ">#14327</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/8cb67669e73cf73bde0a8a9e0a9a829ddd34993f "><code>8cb6766</code></a>
fix: Isolate installer test environment (<a
href="https://redirect.github.com/vercel/turborepo/issues/14326 ">#14326</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/5108f6c9fda7a7aeb2d2f31c46a44bbe966970c7 "><code>5108f6c</code></a>
feat: Add standalone installers URLs for <code>curl | bash</code> (<a
href="https://redirect.github.com/vercel/turborepo/issues/14325 ">#14325</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a46f82a2742ef0f8e1b5f9acebfbe2544c34c528 "><code>a46f82a</code></a>
chore: Release Turborepo 2.11.5-canary.4 (<a
href="https://redirect.github.com/vercel/turborepo/issues/14324 ">#14324</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/8427e6e5dd7efc7afdf5a332502551fc8f2eabc8 "><code>8427e6e</code></a>
fix: Run standalone archive job on manual releases (<a
href="https://redirect.github.com/vercel/turborepo/issues/14323 ">#14323</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/7f57aa38406027a30a77d46489ebbdf9dd3ef0e5 "><code>7f57aa3</code></a>
feat: Publish versioned standalone turbo archives (<a
href="https://redirect.github.com/vercel/turborepo/issues/14322 ">#14322</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/d6b852c53c8473ec88081e826b357feb35938e5e "><code>d6b852c</code></a>
docs: Update Turborepo schema URL example (<a
href="https://redirect.github.com/vercel/turborepo/issues/14321 ">#14321</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c76ac66c4447bfe35301bee0a002d3c60e163342 "><code>c76ac66</code></a>
chore: Release Turborepo 2.11.5-canary.3 (<a
href="https://redirect.github.com/vercel/turborepo/issues/14320 ">#14320</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.12...v2.11.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/releases ">@eslint/eslintrc's
releases</a>.</em></p>
<blockquote>
<h2>eslintrc: v3.3.7</h2>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md ">@eslint/eslintrc's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">3.3.7</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 ">f27e7c9</a>)</li>
<li>update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f ">bb0d97a</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslintrc/commit/7943fa6dd55b236a539f658b88c763a4f9fbb38d "><code>7943fa6</code></a>
chore: release 3.3.7 🚀 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/240 ">#240</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/bb0d97a338937b88fa99d6bbc0a904e34eda3d5f "><code>bb0d97a</code></a>
fix: update js-yaml to 4.3.2 to address security vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/243 ">#243</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/5b4abc9c74dd92b9eb782ca81d559a88906509e9 "><code>5b4abc9</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/f27e7c94e6d9438bd51cb483d8d5da768e1cc0b9 "><code>f27e7c9</code></a>
fix: Bump js-yaml to 4.3.1 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/239 ">#239</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/b75e1d2425deebfd1ec7f952dda7d0c4f4d65d5c "><code>b75e1d2</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/302c13310e148268f990df3edbfd10dab44f2678 "><code>302c133</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/e62e7661b0d9063e42a37af5551bbcb1897e188d "><code>e62e766</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/cf27f9fd8f775d94500f2569a5bfb6a7de9cdb33 "><code>cf27f9f</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/c7f4cdf1ffa86e28b5b8bf09f9e8bc7fadbf87ff "><code>c7f4cdf</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/3319822ac925e018c47fcafa351b20ea0bf6eeff "><code>3319822</code></a>
docs: Update README sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.6...eslintrc-v3.3.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.9.1 to 10.11.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.11.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21271 ">#21271</a>)
(Pavel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/397b3b8134b8ce1a61cbf414d4c29c945ba25690 "><code>397b3b8</code></a>
feat: report unsafe labeled <code>continue</code> in
<code>no-unsafe-finally</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21316 ">#21316</a>)
(electrohyun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d3dd47f42e4cb5f9da27e3a2e741aa21e02ea1a4 "><code>d3dd47f</code></a>
feat: only exempt <code>new-cap</code> built-ins that reference the
global (<a
href="https://redirect.github.com/eslint/eslint/issues/21290 ">#21290</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b684bb1cd7e6be03ad1b7a951baead936d9c2166 "><code>b684bb1</code></a>
fix: make TimePass.parse optional in types and docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21313 ">#21313</a>)
(ntnyq)</li>
<li><a
href="https://github.com/eslint/eslint/commit/26d11bce3e0e21f223613d4bb4be3423839b229e "><code>26d11bc</code></a>
fix: don't report <code>__proto__</code> properties in
<code>object-shorthand</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21310 ">#21310</a>)
(xbinaryx)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)
(bytedoe)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6c789ff39bc5420e94e8dafeb328bf2b7e3d35ab "><code>6c789ff</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5997825635dc9c4e81434894607ef2e3887e0ea3 "><code>5997825</code></a>
docs: clarify preserve-caught-error known limitation (<a
href="https://redirect.github.com/eslint/eslint/issues/21294 ">#21294</a>)
(Akinyemi Toluwalase)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ac74e37322ebf122ada676f153dc55c81f3caab0 "><code>ac74e37</code></a>
chore: Add AGENTS.md with AI disclosure requirements (<a
href="https://redirect.github.com/eslint/eslint/issues/21221 ">#21221</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c8326608e710e670beaf982501aed80ea104919a "><code>c832660</code></a>
chore: Upgrade Stylelint to the latest version in docs (<a
href="https://redirect.github.com/eslint/eslint/issues/21245 ">#21245</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f9f88fcccd965fdc162b89c4615dd4018e3cabdf "><code>f9f88fc</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21308 ">#21308</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fc81076a5b8145360654d81cbc130cf7d25dca77 "><code>fc81076</code></a>
ci: add more types integration tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20395 ">#20395</a>)
(Nitin Kumar)</li>
</ul>
<h2>v10.10.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/264b4346d1963701df0c398b4aeb2f6e8b2af93e "><code>264b434</code></a>
feat: add <code>d</code> and <code>v</code> flags to
<code>no-unexpected-multiline</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21305 ">#21305</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c6cc6c592f30901345d94ef75e0d42c1894fae6c "><code>c6cc6c5</code></a>
feat: check <code>Object.prototype</code> property names in
<code>new-cap</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21269 ">#21269</a>)
(crimsonjay0)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5661fa65fde9fd4c14f0b730e3cee6a42fc657c1 "><code>5661fa6</code></a>
feat: no-extra-bind false negatives with class fields and static blocks
(<a
href="https://redirect.github.com/eslint/eslint/issues/21260 ">#21260</a>)
(synthex-byte)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/bb47dc6da2399a8f76c0c0c3273e6bc314c480e5 "><code>bb47dc6</code></a>
fix: update dependency file-entry-cache to v11 (<a
href="https://redirect.github.com/eslint/eslint/issues/20801 ">#20801</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/427ac0a014066c36aa57fa8fa9af20fd9fb591e1 "><code>427ac0a</code></a>
fix: use format strings in debug calls (<a
href="https://redirect.github.com/eslint/eslint/issues/21247 ">#21247</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9d8153223dbf47b9aecdc1474202aaee4845f146 "><code>9d81532</code></a>
fix: support <code>__proto__</code> in <code>/* exported */</code>
comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21261 ">#21261</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/87e0a082438264ad90b87fd74165ab4fd90f63ef "><code>87e0a08</code></a>
fix: prefer-object-has-own autofix breaks when Object is shadowed (<a
href="https://redirect.github.com/eslint/eslint/issues/21282 ">#21282</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8e2cb142217f2efee1d10dcc02bfb75145ae775d "><code>8e2cb14</code></a>
fix: <code>new-cap</code> false positive for <code>UTC</code> calls with
<code>properties: false</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21275 ">#21275</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9f4a364ab0ade048dfce1f37792b1d461d866e55 "><code>9f4a364</code></a>
fix: Ignore static imports in no-unreachable (<a
href="https://redirect.github.com/eslint/eslint/issues/21276 ">#21276</a>)
(Taha Kotil)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2417cad57d7d1bc4cf3ecf0f0575cfb10ff2011c "><code>2417cad</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9cecb8a0a2348070abf72321965d41919c7cc626 "><code>9cecb8a</code></a>
docs: document <code>\c</code> control letter escapes in
no-control-regex (<a
href="https://redirect.github.com/eslint/eslint/issues/21286 ">#21286</a>)
(한국)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8724829f69f8ed80c876e3a5a017da199ce78739 "><code>8724829</code></a>
docs: update compat table links (<a
href="https://redirect.github.com/eslint/eslint/issues/21263 ">#21263</a>)
(fnx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5634542be580750ffb1a5766470f9e9c72719696 "><code>5634542</code></a>
docs: Clarify eqeqeq suggestion behavior (<a
href="https://redirect.github.com/eslint/eslint/issues/21256 ">#21256</a>)
(Müslüm Yılmaz)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/b3d876b46083d67899eb1d9613118c1c583632a2 "><code>b3d876b</code></a>
chore: disable npm audit in ecosystem tests (<a
href="https://redirect.github.com/eslint/eslint/issues/21306 ">#21306</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1696682791661c13167eb905da2f38d1b8f4a3bf "><code>1696682</code></a>
ci: restore EMFILE test on Node.js 26 (<a
href="https://redirect.github.com/eslint/eslint/issues/21297 ">#21297</a>)
(Marry (Subin Yang))</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/3c0b7c6e1fe2dec778b97a996018126f22d437ae "><code>3c0b7c6</code></a>
10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/321f0a70dd908ed461b11142e17fbdc0c0f1f198 "><code>321f0a7</code></a>
Build: changelog update for 10.11.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68 "><code>520dd77</code></a>
perf: Implement fast paths in critical areas (<a
href="https://redirect.github.com/eslint/eslint/issues/21210 ">#21210</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa "><code>9ecfdc5</code></a>
docs: note that --cache can serve stale results for cross-file rules (<a
href="https://redirect.github.com/eslint/eslint/issues/21312 ">#21312</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a "><code>92086c8</code></a>
test: update <code>EMFILE</code> error generation for Node.js 26.9.0
compatibility (<a
href="https://redirect.github.com/eslint/eslint/issues/21330 ">#21330</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e "><code>9ac7eb6</code></a>
chore: update github/codeql-action action to v4.38.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21331 ">#21331</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476 "><code>22b09f5</code></a>
fix: ignore <code>__proto__</code> properties in
<code>prefer-object-spread</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21311 ">#21311</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd "><code>24310e3</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21324 ">#21324</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127 "><code>d136fa4</code></a>
feat: object-shorthand handle quoted properties for
<code>ignoreConstructors</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21 ">#21</a>...</li>
<li><a
href="https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651 "><code>45ad79e</code></a>
ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/21318 ">#21318</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.9.1...v10.11.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>Vinccool96</li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type] add
rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12730 ">#12730</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-deprecated] report deprecated
imported values used in object shorthand properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12780 ">#12780</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] no false
positive on RHS of a nested logical expression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12728 ">#12728</a>)</li>
<li><strong>eslint-plugin:</strong> [member-ordering] don't report
fields that read fields declared before them (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12729 ">#12729</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9d82e4b1d9011da31d62d14387bb5a539853fafa "><code>9d82e4b</code></a>
chore: expand eslint-plugin rules test files glob (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12878 ">#12878</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f7482f636b89b8eab966b4191ce4a53a3f4b4d9c "><code>f7482f6</code></a>
fix(eslint-plugin): [no-misused-promises] handle multiple Promise
constituent...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/267304477e04538614fe72ad71e7e13082eb7a90 "><code>2673044</code></a>
docs(eslint-plugin): [prefer-promise-reject-errors] add option sections
and e...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f141a2ba63d539465eb4e4604f7d79f6f50ce14 "><code>8f141a2</code></a>
fix(eslint-plugin): [no-useless-default-assignment] convert the fixer to
a su...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/479cd85ff82b81dbec9989621681257ebc317a69 "><code>479cd85</code></a>
chore: enable assertion option <code>requireData</code> for all rule
tests (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12816 ">#12816</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/f3c190c5b5cfa9edaba15fa3f944a76a7364b3ed "><code>f3c190c</code></a>
fix(eslint-plugin): [no-unnecessary-condition] handle union-keyed index
acces...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b1993dfd3c45b2c2d83058627499f1dfec5d6d2c "><code>b1993df</code></a>
fix(eslint-plugin): [unbound-method] treat
Intl.Collator.prototype.compare as...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/da394bc9c21afe97f456040da723d2c558f99658 "><code>da394bc</code></a>
fix(eslint-plugin): [no-unnecessary-parameter-property-assignment]
account fo...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/4a742ff890b7cca8cbf79e78a9a3b345913094c6 "><code>4a742ff</code></a>
fix(eslint-plugin): [await-thenable] prevent autofix from breaking code
when ...</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.68.0 to 8.70.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.70.1</h2>
<h2>8.70.1 (2026-09-21)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>ast-spec:</strong> narrow import attribute keys to
identifiers and strings (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12879 ">#12879</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
avoid false positives on tuples with a rest element (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12768 ">#12768</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
handle type precedence in the suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12637 ">#12637</a>)</li>
<li><strong>eslint-plugin:</strong> [no-explicit-any] use unknown[] for
bare any rest parameters (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12818 ">#12818</a>)</li>
<li><strong>eslint-plugin:</strong> [no-generated-empty-object-type]
don't report a mapped type whose keys are not resolved yet (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12854 ">#12854</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-spread] omit WeakMap
spread suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12850 ">#12850</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
false positive for empty object asserted to a type alias of Record (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12869 ">#12869</a>)</li>
<li><strong>eslint-plugin:</strong> [no-meaningless-void-operator] allow
void on assignment expressions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12873 ">#12873</a>)</li>
<li><strong>eslint-plugin:</strong> [await-thenable] prevent autofix
from breaking code when removing <code>await</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12716 ">#12716</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] account for parameter
reassignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12880 ">#12880</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] treat
Intl.Collator.prototype.compare as spec-bound (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12845 ">#12845</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] handle
union-keyed index access on the left-hand side of nullish assignment (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12747 ">#12747</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
convert the fixer to a suggestion fixer (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12826 ">#12826</a>)</li>
<li><strong>eslint-plugin:</strong> [no-misused-promises] handle
multiple Promise constituents (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12904 ">#12904</a>)</li>
<li><strong>rule-tester:</strong> test the final autofix output instead
of the first pass (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12867 ">#12867</a>)</li>
<li><strong>scope-manager:</strong> merge implicit global definitions
(<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12809 ">#12809</a>)</li>
<li><strong>type-utils:</strong> match package specifiers on whole path
components (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12838 ">#12838</a>)</li>
<li><strong>typescript-estree:</strong> resolve symlinked paths when
matching files to projects (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12725 ">#12725</a>)</li>
<li><strong>typescript-estree:</strong> add missing <code><</code>
token opening type arguments (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12821 ">#12821</a>)</li>
<li><strong>typescript-estree:</strong> require string literal import
attribute values (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12894 ">#12894</a>)</li>
<li><strong>website:</strong> prevent playground from breaking down
after opening link with the .js file type (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12777 ">#12777</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Amin <a
href="https://github.com/amiin-dev "><code>@amiin-dev</code></a></li>
<li>Brad Zacher <a
href="https://github.com/bradzacher "><code>@bradzacher</code></a></li>
<li>Cameron</li>
<li>Diptajoy Mistry <a
href="https://github.com/diptomistry "><code>@diptomistry</code></a></li>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Grit <a
href="https://github.com/Grit03 "><code>@Grit03</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov "><code>@mnaoumov</code></a></li>
<li>Mikhail Baev <a
href="https://github.com/baevm "><code>@baevm</code></a></li>
<li>Om Rawat</li>
<li>overlookmotel</li>
<li>Sanath <a
href="https://github.com/sansynx "><code>@sansynx</code></a></li>
<li>Shinji</li>
<li>stoicism <a
href="https://github.com/stoicism02 "><code>@stoicism02</code></a></li>
<li>Vinccool96</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
<li>김채영 <a
href="https://github.com/cchaeyoung "><code>@cchaeyoung</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.70.1 (2026-09-21)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.70.0 (2026-09-07)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.69.0 (2026-08-31)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.69.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/23d38ceeb8fb1237f55cb62fc2b54419e1fa1ed7 "><code>23d38ce</code></a>
chore(release): publish 8.70.1</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/7ee76085c22e923c0036b8e0733a3ca7dfd82b60 "><code>7ee7608</code></a>
chore(release): publish 8.70.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9a6e546823e5d8f2dc015df2aa66c0230615e209 "><code>9a6e546</code></a>
chore(release): publish 8.69.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.6 to 3.9.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases ">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.9</h2>
<ul>
<li>Markdown: Fix text with <code>$</code> been incorrectly parsed as
math syntax (<a
href="https://redirect.github.com/prettier/prettier/pull/20140 ">#20140</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.9/CHANGELOG.md#399 ">Changelog</a></p>
<h2>3.9.8</h2>
<ul>
<li>Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/pull/20087 ">#20087</a>
by <a href="https://github.com/seiyab "><code>@seiyab</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.8/CHANGELOG.md#398 ">Changelog</a></p>
<h2>3.9.7</h2>
<ul>
<li>Support Angular 22.2</li>
<li>Fix regressions in v3.9</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.7/CHANGELOG.md#397 ">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md ">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.9</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.8...3.9.9 ">diff</a></p>
<h4>Markdown: Fix text with <code>$</code> been incorrectly parsed as
math syntax (<a
href="https://redirect.github.com/prettier/prettier/pull/20140 ">#20140</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="md"><code><!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before
anything else runs here.
<p><!-- Prettier 3.9.8 -->
<strong>Uses $FOO</strong> from <code>a.sh</code> and <code>b.sh</code>,
plus <code>$BAR</code>from<code>c.sh</code>, before anything else runs
here.</p>
<p><!-- Prettier 3.9.9 -->
<strong>Uses $FOO</strong> from <code>a.sh</code> and <code>b.sh</code>,
plus <code>$BAR</code> from <code>c.sh</code>, before anything else runs
here.
</code></pre></p>
<h1>3.9.8</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.7...3.9.8 ">diff</a></p>
<h4>Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/pull/20087 ">#20087</a>
by <a href="https://github.com/seiyab "><code>@seiyab</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="markdown"><code><!-- Input -->
If `module` is not a
[`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module )
object instance, a
{{jsxref("TypeError")}} is thrown.
<p><!-- Prettier 3.9.7 -->
If <code>module</code> is not a <a
href="https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module "><code>WebAssembly.Module</code></a>
object instance, a</p>
<p>{{jsxref("TypeError")}} is thrown.</p>
<p><!-- Prettier 3.9.8 -->
If <code>module</code> is not a <a
href="https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module "><code>WebAssembly.Module</code></a>
object instance, a
{{jsxref("TypeError")}} is thrown.
</code></pre></p>
<h1>3.9.7</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.6...3.9.7 ">diff</a></p>
<h4>Markdown: Prevent indentation drift in list-item code blocks (<a
href="https://redirect.github.com/prettier/prettier/pull/19647 ">#19647</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19990 ">#19990</a>
by <a
href="https://github.com/Austin1serb "><code>@Austin1serb</code></a>, <a
href="https://github.com/giaBaoJS "><code>@giaBaoJS</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="markdown"><code><!-- Input -->
- [x] short first line.
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/cdd17f2288b28b170a76416c72dac56e3ea5daff "><code>cdd17f2</code></a>
Release 3.9.9</li>
<li><a
href="https://github.com/prettier/prettier/commit/dc7b8968e678f51ea00e2be3fe8c717d114691a3 "><code>dc7b896</code></a>
Disable <code>singleDollarTextMath</code> in
<code>mdast-util-math</code> (<a
href="https://redirect.github.com/prettier/prettier/issues/20140 ">#20140</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/f9be58fb8ec62dd47197ea19a30aac5ad26dfee0 "><code>f9be58f</code></a>
Git blame ignore 3.9.8</li>
<li><a
href="https://github.com/prettier/prettier/commit/88470cb79ca3b757dd6b93906d9a992aa1a456c3 "><code>88470cb</code></a>
Bump Prettier dependency to 3.9.8</li>
<li><a
href="https://github.com/prettier/prettier/commit/9559cab39eb5082c99a27e8829760c055adba841 "><code>9559cab</code></a>
Clean changelog_unreleased</li>
<li><a
href="https://github.com/prettier/prettier/commit/4fc8ee87465de8d54780273a6996d74e8e9da827 "><code>4fc8ee8</code></a>
Update dependents count</li>
<li><a
href="https://github.com/prettier/prettier/commit/4f2ab6765d7cb29408a2abdac75d023d64d44107 "><code>4f2ab67</code></a>
Release 3.9.8</li>
<li><a
href="https://github.com/prettier/prettier/commit/3d82af8b15b8e89de20dd05cc65f66ab6d4ce8b0 "><code>3d82af8</code></a>
Update Regex related dependencies (<a
href="https://redirect.github.com/prettier/prettier/issues/20082 ">#20082</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/5ec8db1745c2bdcca3706ab8cfbbe5c11fc457c1 "><code>5ec8db1</code></a>
[3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (<a
href="https://redirect.github.com/prettier/prettier/issues/20087 ">#20087</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/5b142ed2bce0095161bf6865af30df2d5ba99466 "><code>5b142ed</code></a>
Release Release <code>@prettier/plugin-hermes</code><a
href="https://github.com/0 "><code>@0</code></a>.2.3,
<code>@prettier/plugin-oxc</code><a
href="https://github.com/0 "><code>@0</code></a>.2.3, an...</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.9.6...3.9.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.2.9 to 1.2.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.13</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11714 ">#11714</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/a83dfb14f8e17fcb66dc7a915f0cf8ed7b0dffa1 "><code>a83dfb1</code></a>
Thanks <a href="https://github.com/ccurme "><code>@ccurme</code></a>! -
Abbreviate long tool-call IDs when formatting chat messages as strings,
keeping original messages unchanged.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.12</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11675 ">#11675</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/030a726639e0147488bc8c23c063a2e72b004c2e "><code>030a726</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Preserve structured tool arguments in tracer run inputs.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11603 ">#11603</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/fec9cd87b01976014dd549bd2cf7849aee89a566 "><code>fec9cd8</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- fix(core): build streaming <code>llmOutput.tokenUsage</code> from the
fully-accumulated chunk instead of whichever individual chunk's
<code>usage_metadata</code> arrived last</p>
<p>Affects both core streaming paths —
<code>.stream()</code>/<code>.streamEvents()</code>
(<code>_streamIterator</code>) and
<code>.invoke()</code>/<code>.generate()</code> when a
streaming-preferring callback is attached
(<code>_generateWithCache</code>'s <code>hasStreamingHandler</code>
branch). Previously, <code>llmOutput.tokenUsage</code> was overwritten
by each chunk in turn, so only the last chunk carrying
<code>usage_metadata</code> won — correct for providers that emit one
cumulative total on a final chunk, but wrong for providers (e.g.
<code>@langchain/google</code>, <code>@langchain/anthropic</code>) that
emit <code>usage_metadata</code> as a per-chunk delta across multiple
chunks, where the values must be summed.</p>
<p>Note for provider authors: this assumes each streamed chunk's
<code>usage_metadata</code> is either a per-chunk delta or appears only
on a single final chunk. A provider that instead repeats a cumulative
total on every chunk will now see it summed (and inflated) in
<code>llmOutput.tokenUsage</code>, matching the existing behavior of the
correctly-working <code>message.usage_metadata</code> field.</p>
<p>Also fixes <code>@langchain/google</code>'s <code>invoke({streaming:
true})</code> path (no streaming-preferring callback attached), where
<code>llmOutput</code> was never populated at all.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11590 ">#11590</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ffebdc2f00f3290d19f85e5afd6a297920ae584c "><code>ffebdc2</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- Fix OpenAI Responses API replay under Zero Data Retention when a
response contains more than one reasoning item, for both v0 and v1. In
v0, the default replay path now reuses
<code>response_metadata.output</code> directly, preserving every
reasoning item's <code>id</code>/<code>encrypted_content</code> in
original order. In v1, <code>AIMessage.contentBlocks</code>
(<code>outputVersion: "v1"</code>) is fixed the same way.
<code>additional_kwargs.reasoning</code> is unchanged.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/10047 ">#10047</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/ff1248fd49dacdb35f5da128278cd777068481d7 "><code>ff1248f</code></a>
Thanks <a
href="https://github.com/afirstenberg "><code>@afirstenberg</code></a>!
- fix(core): BaseMessage.text use contentBlocks</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8d12783ecc31a0816f3a47da1040fbd3c08fdbc "><code>c8d1278</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11729 ">#11729</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5d509ad4b8a5ed9dd4b83020b4c103ac8a69859c "><code>5d509ad</code></a>
fix(openai): send in-memory prompt cache retention as in_memory (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11735 ">#11735</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/663b9a2076c5b274435c77524ad7730450b34f34 "><code>663b9a2</code></a>
feat(openai): support explicit prompt caching (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11232 ">#11232</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7735b219221d6ae63eb5445fb67d26c18fce9c46 "><code>7735b21</code></a>
chore(infra): drop held mcp-adapters 2.0 changeset to unblock main
releases (...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/34edee1153f0fa40ba6997c8ff7bd45834ca8ce8 "><code>34edee1</code></a>
fix(langchain): return failed returnDirect tool calls to the model (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11712 ">#11712</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0fcb98b4306a771c940e78d6881d0be9f88507c1 "><code>0fcb98b</code></a>
fix(textsplitters): use char length for loc.lines with custom
lengthFunction ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e4a3d1bd0c6753d4e1739a7f10064f48e6bc49ec "><code>e4a3d1b</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11683 ">#11683</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a9ada857f22c4b746801e77 ...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:51:50 -07:00
dependabot[bot]
7c8be00fd6
chore(deps): bump the minor-and-patch group in /libs/cli with 5 updates ( #9153 )
...
Bumps the minor-and-patch group in /libs/cli with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph ) | `0.4.4` |
`0.4.5` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock ) | `3.15.1` |
`3.16.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.5` | `0.16.9` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.75` | `0.0.84` |
| [hatch](https://github.com/pypa/hatch ) | `1.18.0` | `1.18.1` |
Updates `langgraph-sdk` from 0.4.4 to 0.4.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.5</h2>
<p>Changes since sdk==0.4.4</p>
<ul>
<li>release(sdk-py): 0.4.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8988 ">#8988</a>)</li>
<li>release(langgraph): 1.2.12 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8987 ">#8987</a>)</li>
<li>chore(deps): bump anyio from 4.14.2 to 4.15.1 in /libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8997 ">#8997</a>)</li>
<li>chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/cli (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8998 ">#8998</a>)</li>
<li>chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8994 ">#8994</a>)</li>
<li>feat(langgraph): add response_schema to interrupt() (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8886 ">#8886</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8779 ">#8779</a>)</li>
<li>chore(deps): bump websockets from 16.0 to 16.1.1 in /libs/sdk-py in
the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8781 ">#8781</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/6fb2a93212ceeb432c13148849082af0775318a1 "><code>6fb2a93</code></a>
langgraph: release 0.4.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4709 ">#4709</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3f8944c1fc560c6b8d700110c7b7764e5c769beb "><code>3f8944c</code></a>
checkpoint: release 2.0.26 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4708 ">#4708</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/e79f3ceedc2508e18b7753d793a90e60ffad0b74 "><code>e79f3ce</code></a>
Improve how we match cached writes for async imperative tasks (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4691 ">#4691</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3bdb7d09beae7e1fcfebe86aa91b18e5a93d2cc1 "><code>3bdb7d0</code></a>
Lint</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3acf63a918c6f5f59e9a3a4e2c629314e4f6099a "><code>3acf63a</code></a>
Lint</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/f51e5e2bd73f1678353bf7e01b09daf1c67cbd0f "><code>f51e5e2</code></a>
Improve how we match cached writes for async imperative tasks</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.4...0.4.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pytest-mock` from 3.15.1 to 3.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/releases ">pytest-mock's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/604 ">#604</a>:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/611 ">#611</a>:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/pull/606 ">#606</a>:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/547 ">#547</a>:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/147 ">#147</a>:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst ">pytest-mock's
changelog</a>.</em></p>
<blockquote>
<h2>3.16.0</h2>
<p><em>2026-09-27</em></p>
<ul>
<li><code>[#604 ](https://github.com/pytest-dev/pytest-mock/issues/604 )
<https://github.com/pytest-dev/pytest-mock/pull/604> ;</code>_:
Fixed <code>duplicate_iterators=True</code> for async functions spied
with <code>mocker.spy</code>.</li>
<li><code>[#611 ](https://github.com/pytest-dev/pytest-mock/issues/611 )
<https://github.com/pytest-dev/pytest-mock/pull/611> ;</code>_:
Fixed async mock assertion introspection to use awaited arguments
instead of the latest call's arguments.</li>
<li><code>[#606 ](https://github.com/pytest-dev/pytest-mock/issues/606 )
<https://github.com/pytest-dev/pytest-mock/pull/606> ;</code>_:
<code>mocker.resetall(return_value=True, side_effect=True)</code> now
also applies to non-callable mocks, such as those returned by
<code>mocker.create_autospec(SomeClass, instance=True)</code>.
Previously both arguments were silently ignored for them.</li>
<li><code>[#547 ](https://github.com/pytest-dev/pytest-mock/issues/547 )
<https://github.com/pytest-dev/pytest-mock/issues/547> ;</code>_:
Added <code>SpyType</code> for annotating <code>mocker.spy</code>
results.</li>
<li>Dropped support for EOL Python 3.9.</li>
<li><code>[#147 ](https://github.com/pytest-dev/pytest-mock/issues/147 )
<https://github.com/pytest-dev/pytest-mock/issues/147> ;</code>_:
Removed handling of <code>RuntimeError: stop called on unstarted
patcher</code>, which can no longer occur in the supported Python
versions.</li>
<li>Added support for Python 3.15.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/f3b531f93c6d9837edc87ea1a6f4324dc9a2cdf3 "><code>f3b531f</code></a>
Release 3.16.0</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/71ed67309520be160f3e100368705b58758d237a "><code>71ed673</code></a>
Fix duplicate_iterators for async spies (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/604 ">#604</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/0797e3d303cc5bbe0a3514b0625f7aeb3fa350b0 "><code>0797e3d</code></a>
Fix async assertion argument introspection (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/611 ">#611</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/e24c334d573cfbf6989a31f4e3346676d9d31598 "><code>e24c334</code></a>
docs: import os in the opening usage example (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/612 ">#612</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/9e7eb7b59cde362c1c8ace2d18ca00fe2d7a1cd1 "><code>9e7eb7b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/613 ">#613</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/445fd4d3daa8ed4c6d5428a77880da2e03d2f721 "><code>445fd4d</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/610 ">#610</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/a8bd0b147afdf6b4bb1a1a3c3c088f32b0240091 "><code>a8bd0b1</code></a>
Honour resetall() arguments for non-callable mocks (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/606 ">#606</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/6559fdfd5b67f096423e604a3a5a7045db2486a0 "><code>6559fdf</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/608 ">#608</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/466d026254c949a8fbba8626b894308827be81cf "><code>466d026</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/605 ">#605</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest-mock/commit/164defebde25bc31d53a2a64943c5c9aac43b57e "><code>164defe</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pytest-dev/pytest-mock/issues/603 ">#603</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.5 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309 ">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776 ">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767 ">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616 ">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542 ">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699 ">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651 ">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334 ">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509 ">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794 ">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719 ">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev "><code>@qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith "><code>@sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran "><code>@webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot "><code>@zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone "><code>@spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12 "><code>@IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge "><code>@devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir "><code>@GruffElixir</code></a></li>
</ul>
<h2>0.16.8</h2>
<p>Released on 2026-09-16.</p>
<h3>Bug fixes</h3>
<ul>
<li>Visit functional <code>TypedDict</code> keyword arguments correctly
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28584 ">#28584</a>)</li>
<li>[<code>flake8-simplify</code>] Detect nested <code>async with</code>
under sync parent (<code>SIM117</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27821 ">#27821</a>)</li>
<li>[<code>flake8-simplify</code>] Preserve operand order in
<code>SIM109</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27824 ">#27824</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1 "><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882 ">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02 "><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881 ">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18 "><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880 ">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c "><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d "><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876 ">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b "><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877 ">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7 "><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871 ">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca "><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855 ">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1 "><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869 ">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff "><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867 ">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.75 to 0.0.84
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.84</h2>
<p>Released on 2026-09-24.</p>
<p>This release addresses <a
href="https://github.com/astral-sh/ty/security/advisories/GHSA-vxvm-j4xq-q7m4 ">GHSA-vxvm-j4xq-q7m4</a>,
a use-after-free vulnerability during incremental type checking that can
result in arbitrary code execution when analyzing a specially crafted
Python project. Users who run ty on untrusted code should upgrade to
0.0.84 or newer.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix stale diagnostics from the LSP server after toggling
<code>showSyntaxErrors</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28759 ">#28759</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Complete string keys from dictionary initializers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28820 ">#28820</a>)</li>
<li>Support LSP requests against closed documents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28595 ">#28595</a>)</li>
<li>Select projects for external files using import search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28594 ">#28594</a>)</li>
<li>Use workspace editor settings for external files (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28639 ">#28639</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid repeated subtyping checks for materialized recursive protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28774 ">#28774</a>)</li>
<li>Skip reading notebooks when discovering scripts (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28781 ">#28781</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid incorrect simplification of <code>TypeIs</code>
materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28817 ">#28817</a>)</li>
<li>Fix disjointness of generic class types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28787 ">#28787</a>)</li>
<li>Fix staticmethod shadowing through generic receivers and unions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28766 ">#28766</a>)</li>
<li>Infer callable signatures from bounded type variables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28599 ">#28599</a>)</li>
<li>Infer constant membership in inline list and set literals (e.g.
<code>"foo" in ["foo"]</code> is now inferred as
<code>Literal[True]</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28676 ">#28676</a>)</li>
<li>Infer through optional generic containers in the legacy solver (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28791 ">#28791</a>)</li>
<li>Preserve call narrowing during cyclic inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28708 ">#28708</a>)</li>
<li>Preserve intersections of type guard return types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28796 ">#28796</a>)</li>
<li>Use subtyping for constraint-set implication (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28657 ">#28657</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Disable <code>invalid-legacy-positional-parameter</code> by default
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28834 ">#28834</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Only consider reachable definitions when determining whether a
condition should be exempted from
<code>redundant-condition(-strict)</code> due to the condition being
defined relative to <code>sys.version_info</code>,
<code>sys.platform</code>, <code>os.name</code> or
<code>typing.TYPE_CHECKING</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28788 ">#28788</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/ibraheemdev "><code>@ibraheemdev</code></a></li>
<li><a href="https://github.com/zsol "><code>@zsol</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a
href="https://github.com/lerebear "><code>@lerebear</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
<li><a
href="https://github.com/ewdurbin "><code>@ewdurbin</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/8dd9a7f7fa35a18275d82117e6593ba45507065f "><code>8dd9a7f</code></a>
Bump version to 0.0.84 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4585 ">#4585</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d4e4bf90906c7677049bc3a29d1735de7d22052d "><code>d4e4bf9</code></a>
publish to astral-sh/versions via OIDC (<a
href="https://redirect.github.com/astral-sh/ty/issues/4581 ">#4581</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/94ce7333abb356b2068dc98d37a68c993da6d09b "><code>94ce733</code></a>
use oidc issued token for docs publication (<a
href="https://redirect.github.com/astral-sh/ty/issues/4579 ">#4579</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/901eeaa9cd9ac06f34e85e4f721f76a0dc36e217 "><code>901eeaa</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4576 ">#4576</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/09bf0b1b2114a628f3e2296d3d9d28245066c98b "><code>09bf0b1</code></a>
Update docker/setup-buildx-action action to v4.3.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4575 ">#4575</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/89d6ffe529dd44f64adc0d28f80744b7c7ab217f "><code>89d6ffe</code></a>
Update astral-sh/setup-uv action to v10.2.0 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4574 ">#4574</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/9c214798cfcc59069e986876564638fadf32d774 "><code>9c21479</code></a>
Bump version to 0.0.83 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4569 ">#4569</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/04c69110b391e96310e6892cbed9936c4f31d7aa "><code>04c6911</code></a>
Sync the ty security mirror (<a
href="https://redirect.github.com/astral-sh/ty/issues/4549 ">#4549</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/3fa57a25767c619dbeba697c2acfbb8eb291519a "><code>3fa57a2</code></a>
Grant the versions workflow repository read access (<a
href="https://redirect.github.com/astral-sh/ty/issues/4550 ">#4550</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a15b35389b44db57f718fd4e19e093481747c53e "><code>a15b353</code></a>
use scoped token for release workflow (<a
href="https://redirect.github.com/astral-sh/ty/issues/4506 ">#4506</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.75...0.0.84 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `hatch` from 1.18.0 to 1.18.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/hatch/releases ">hatch's
releases</a>.</em></p>
<blockquote>
<h2>Hatch v1.18.1</h2>
<p><em><strong>Added:</strong></em></p>
<ul>
<li>Apply context formatting to the <code>lock-filename</code>
environment option so fields such as <code>{env_name}</code> and
<code>{matrix:...}</code> are resolved when computing the lock file
path.</li>
</ul>
<p><em><strong>Fixed:</strong></em></p>
<ul>
<li>
<p>Consolidate extras and feature resolution into a single code path,
fixing regressions where environment and project extras could be dropped
or resolved inconsistently, and always validate undefined features.</p>
</li>
<li>
<p>Normalize hyphens in the plugin name when building environment option
environment variable names in <code>get_env_var()</code>, so options for
hyphenated plugins resolve to the correct variable.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/hatch/commit/4b17561f822b1b416403a61855374892ecbe11de "><code>4b17561</code></a>
release Hatch v1.18.1 (<a
href="https://redirect.github.com/pypa/hatch/issues/2426 ">#2426</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/b6aaa1a3cac6be652ac90c8c79612bddcca733ea "><code>b6aaa1a</code></a>
release Hatchling v1.32.1 (<a
href="https://redirect.github.com/pypa/hatch/issues/2425 ">#2425</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/47f333a98228c326786d3919f346bd7b74d9cf8f "><code>47f333a</code></a>
Prepare for hatch and hatchling releases (<a
href="https://redirect.github.com/pypa/hatch/issues/2424 ">#2424</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/d5f7bfe813dd4d81520def23b43f5d46aad1899c "><code>d5f7bfe</code></a>
Fix version metadata to preserve leading zeros in CalVer (<a
href="https://redirect.github.com/pypa/hatch/issues/2398 ">#2398</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/cbfc465e019ff51460f80ebbc35370e476aed6b9 "><code>cbfc465</code></a>
Context formatting support for <code>lock-filename</code> (<a
href="https://redirect.github.com/pypa/hatch/issues/2412 ">#2412</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/929362c909899556ae4efd1f61a3b078677ad235 "><code>929362c</code></a>
Mark a few more tests that require Internet access (<a
href="https://redirect.github.com/pypa/hatch/issues/2400 ">#2400</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/c9d4e8a82a81835e1ed8b29e6885631d7f5aecb3 "><code>c9d4e8a</code></a>
Fix env var formatting in <code>get_env_var()</code> function (<a
href="https://redirect.github.com/pypa/hatch/issues/2397 ">#2397</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/84023e0b77ddec3aa3015cd9b57f78f00da2cb18 "><code>84023e0</code></a>
Some type fixes (<a
href="https://redirect.github.com/pypa/hatch/issues/1138 ">#1138</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/ed8e30bebf98f2fe4d70c18a32a50a8160c391cb "><code>ed8e30b</code></a>
Refactor extras so that the logic is in one place (<a
href="https://redirect.github.com/pypa/hatch/issues/2382 ">#2382</a>)</li>
<li>See full diff in <a
href="https://github.com/pypa/hatch/compare/hatch-v1.18.0...hatch-v1.18.1 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:51:40 -07:00
dependabot[bot]
e9bde462f2
chore(deps-dev): bump types-requests from 2.33.0.20260712 to 2.33.0.20260906 in /libs/langgraph ( #9156 )
...
Bumps [types-requests](https://github.com/python/typeshed ) from
2.33.0.20260712 to 2.33.0.20260906.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits ">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-01 01:51:29 -07:00
dependabot[bot]
4be610c6bc
chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph ( #9140 )
...
Bumps [pyjwt](https://github.com/jpadilla/pyjwt ) from 2.15.0 to 2.15.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases ">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.15.1</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.15.1/CHANGELOG.rst ">2.15.1
changelog</a> for complete release details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst ">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.15.1
<https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1> ;</code>__</h2>
<p>Fixed</p>
<pre><code>
- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
tokens issued by AWS ALB and similar systems verify instead of raising
``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
``!!!!`` remains rejected
(`[#1209 ](https://github.com/jpadilla/pyjwt/issues/1209 )
<https://github.com/jpadilla/pyjwt/issues/1209> ;`__).
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/7d5ef55e42ce42221f58dc49943e92ccad1fa66a "><code>7d5ef55</code></a>
chore: prepare 2.15.1 release</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/7bf32526738fe837387bdedd4849a4a525c33a79 "><code>7bf3252</code></a>
Accept canonical Base64URL padding in JWT segments (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1216 ">#1216</a>)</li>
<li>See full diff in <a
href="https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 12:28:57 -07:00
dependabot[bot] and John Kennedy
98b10ba0ff
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-conformance ( #9133 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-09-30 18:50:53 +00:00
dependabot[bot]
ffe4e8cd6d
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph ( #9138 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:43:51 -07:00
dependabot[bot]
f75add0ee9
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/cli ( #9137 )
...
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:43:37 -07:00
dependabot[bot]
902be1eb2b
chore(deps): bump the uv group across 2 directories with 1 update ( #9136 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory: [urllib3](https://github.com/urllib3/urllib3 ).
Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple
directory: [urllib3](https://github.com/urllib3/urllib3 ).
Updates `urllib3` from 2.7.0 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `urllib3` from 2.7.0 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:43:23 -07:00
dependabot[bot]
3b969324db
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-sqlite ( #9135 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:43:08 -07:00
dependabot[bot]
e43f0f5f1e
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/sdk-py ( #9134 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:42:51 -07:00
dependabot[bot]
8ccdedcc1b
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-postgres ( #9132 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:42:38 -07:00
dependabot[bot]
7ea31e5e45
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint ( #9131 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:42:23 -07:00
dependabot[bot]
313e0e7e0a
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/prebuilt ( #9130 )
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 2.7.0 to 2.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases ">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support ">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project. If your company or
organization uses Python and would benefit from HTTP/2 support in
Requests, pip, cloud SDKs, and thousands of other projects <a
href="https://opencollective.com/urllib3 ">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden. (High severity, GHSA-8988-9cw3-xx77)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size line of unbounded length in memory. (High
severity, GHSA-vxq7-64xx-v4gw)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity, GHSA-gh4c-6fx4-qh6g)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.</p>
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>. Destination client certificates
and identity overrides no longer apply to HTTPS forwarding proxy
connections.</p>
</blockquote>
<blockquote>
<p>[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of
release due to a backlog at GitHub's CNA.</p>
</blockquote>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option <code>allowed_methods</code> to retry any verb. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5044 ">#5044</a>)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience properties to the
result of <code>parse_url()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4945 ">#4945</a>)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5092 ">#5092</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed response header handling to replace obsolete folded header
lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112,
preventing raw CRLF sequences from appearing in header values such as
<code>Set-Cookie</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/1362 ">#1362</a>)</p>
</li>
<li>
<p>Fixed usage of <code>proxy_ssl_context</code> with
<code>ProxyManager</code> when
<code>use_forwarding_for_https=True</code>. Passing
<code>ssl_context</code> instead of <code>proxy_ssl_context</code> for
HTTPS proxies in this configuration now emits a
<code>FutureWarning</code> and will raise an error in v3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/2577 ">#2577</a>)</p>
</li>
<li>
<p>Changed behavior of the default <code>ConnectionPool.pool</code>
initialization. <code>LifoQueue</code> is now resolved from the
<code>queue</code> module after the <code>ConnectionPool</code> is
instantiated instead of using the default cached <code>QueueCls</code>
class property. This is done because sometimes the
<code>queue.LifoQueue</code> is monkey-patched late in the program, such
as by gevent. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3289 ">#3289</a>)</p>
</li>
<li>
<p>Raised <code>UnrewindableBodyError</code> instead of
<code>ValueError</code> when retrying a request whose body had
<code>tell()</code> but not <code>seek()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3779 ">#3779</a>)</p>
</li>
<li>
<p>Decoded percent-encoded SOCKS proxy credentials before authenticating
with the proxy server. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3785 ">#3785</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread
response data in 64 KiB chunks (same as the default <code>amt</code>
when doing <code>HTTPResponse.stream(...)</code>). (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5019 ">#5019</a>)</p>
</li>
<li>
<p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms
accepted by <code>socket.connect</code>, such as hex
(<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal
integers (<code>2130706433</code>), ensuring SSL certificate
verification uses the correct mode for these addresses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5029 ">#5029</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading
<code>FullPoolError</code> instead of <code>ValueError</code> when
called with an invalid <code>timeout</code> argument on a pool created
with <code>block=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5059 ">#5059</a>)</p>
</li>
<li>
<p>Fixed port-zero handling to preserve explicit <code>:0</code> values
instead of substituting the default ports 80 or 443 in URL parsing, pool
selection, proxy configuration, <code>connection_from_url()</code>, and
HTTP/2 request authority. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5071 ">#5071</a>,
<a
href="https://redirect.github.com/urllib3/urllib3/issues/5101 ">#5101</a>)</p>
</li>
<li>
<p>Fixed a bug where <code>PoolManager</code> passed the
<code>assert_hostname</code> and <code>assert_fingerprint</code>
parameters to HTTP connection pools. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5077 ">#5077</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy
forwarding to strip URL fragments from absolute request targets before
sending requests. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5079 ">#5079</a>)</p>
</li>
<li>
<p>Added safeguards to the proxy tunneling code to prevent potential
security issues when handling invalid characters in the proxy host and
HTTP headers. This change affects users of Python 3.10, Python 3.11, and
Python 3.12 when the standard library does not contain the fix; those on
newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the
same security fixes. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5091 ">#5091</a>)</p>
</li>
<li>
<p>Fixed <code>HTTPSConnection.connect()</code> overriding
<code>ProxyConfig.ssl_context</code>'s certificate policy and proxy
identity checks with the target connection's TLS settings when
forwarding through an HTTPS proxy.</p>
<p><code>HTTPSConnection</code> no longer applies target SNI,
assertions, or client credentials to forwarding proxy handshakes and
continues to use its <code>ssl_context</code> as a fallback when an
HTTPS proxy forwards an HTTP target. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5093 ">#5093</a>)</p>
</li>
<li>
<p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax,
rejecting invalid host input such as raw spaces and control characters,
malformed percent-encodings, and percent-encoded control characters in
HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel
targets. Host normalization now also follows RFC 3986 normalization
rules for percent-encoded octets by decoding percent-encoded unreserved
characters and uppercasing the hexadecimal digits of retained
percent-encoded octets. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5095 ">#5095</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst ">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.8.0 (2026-09-15)</h1>
<h2>Security</h2>
<p>Fixed the following security issues:</p>
<ul>
<li>The TLS configuration for HTTPS proxies could be ignored or
overridden.
(High severity, <code>GHSA-8988-9cw3-xx77
<https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77> ;</code>__)</li>
<li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code>
could buffer a chunk-size
line of unbounded length in memory. (High severity,
<code>GHSA-vxq7-64xx-v4gw
<https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw> ;</code>__)</li>
<li>Chunked Deflate streaming could enter an infinite loop. (Medium
severity,
<code>GHSA-gh4c-6fx4-qh6g
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g> ;</code>__)</li>
</ul>
<p>.. caution::</p>
<pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
<p>Configure proxy CA certificates and client certificates in
<code>proxy_ssl_context</code>, and proxy identity checks with
<code>proxy_assert_hostname</code> or
<code>proxy_assert_fingerprint</code>.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
</code></pre></p>
<h2>Deprecations & Removals</h2>
<ul>
<li>Deprecated using an empty collection as the <code>Retry</code>
option
<code>allowed_methods</code> to retry any verb.
(<code>[#5044 ](https://github.com/urllib3/urllib3/issues/5044 )
<https://github.com/urllib3/urllib3/issues/5044> ;</code>__)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Added <code>Url.auth_decoded</code> and
<code>Url.auth_decoded_joined</code> convenience
properties to the result of <code>parse_url()</code>.
(<code>[#4945 ](https://github.com/urllib3/urllib3/issues/4945 )
<https://github.com/urllib3/urllib3/issues/4945> ;</code>__)</li>
<li>Added <code>basic_auth_encoding</code> and
<code>proxy_basic_auth_encoding</code> parameters to
<code>urllib3.util.make_headers()</code>.
(<code>[#5092 ](https://github.com/urllib3/urllib3/issues/5092 )
<https://github.com/urllib3/urllib3/issues/5092> ;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a "><code>b1d30ab</code></a>
Release 2.8.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e "><code>9016d7e</code></a>
Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for
brotlicffi (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5258 ">#5258</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533 "><code>9101f58</code></a>
Fix <code>nox -s docs</code> warning (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5256 ">#5256</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed "><code>cd770b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f "><code>ea2ad7b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8 "><code>0716e31</code></a>
Fix loading unencrypted client keys with a password in pyOpenSSL (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5255 ">#5255</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d "><code>43c68c8</code></a>
Test pickling of <code>InvalidChunkLength</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5247 ">#5247</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817 "><code>308b279</code></a>
Share security policy between GitHub and Read the Docs (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5253 ">#5253</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706 "><code>53fa073</code></a>
Add policy on duplicate pull requests (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5252 ">#5252</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267 "><code>5f2a6a8</code></a>
Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a
href="https://redirect.github.com/urllib3/urllib3/issues/5232 ">#5232</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:42:08 -07:00
dependabot[bot]
b9919ace32
chore(deps): bump pyjwt from 2.13.0 to 2.15.0 in /libs/cli ( #9129 )
...
Bumps [pyjwt](https://github.com/jpadilla/pyjwt ) from 2.13.0 to 2.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases ">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.15.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst ">2.15.0
changelog</a> for complete release details.</p>
<h2>2.14.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst ">2.14.0
changelog</a> for the complete release details and related security
advisories.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst ">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.15.0
<https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0> ;</code>__</h2>
<p>Security</p>
<pre><code>
- Wrap recursion errors from deeply nested JWT payloads in
``DecodeError``
instead of exposing a raw ``RecursionError``.
<p>Added</p>
<pre><code>
- Support Python 3.15 by @kytta in
`[#1202 ](https://github.com/jpadilla/pyjwt/issues/1202 )
&lt;https://github.com/jpadilla/pyjwt/pull/1202&gt ;`__
Changed
</code></pre>
<ul>
<li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code>
rather than the raw JWKS
payload, so a cache hit no longer re-parses every key.
<code>JWKSetCache.put()</code>
accepts either form and raises <code>PyJWKSetError</code> for anything
else. As a
result, <code>PyJWKClient.get_jwk_set()</code> returns the same
<code>PyJWKSet</code> instance
for as long as it stays cached, rather than a freshly built one per call
in
<code>[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;</code>__</li>
<li><code>PyJWKClient.fetch_data()</code> now raises
<code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
object&quot;)</code> when
the endpoint response is not a JSON object, instead of returning it for
<code>get_jwk_set()</code> to reject. Callers reaching the JWKS through
<code>get_jwk_set()</code> see the same error as before in
<code>[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;</code>__</li>
</ul>
<p>Fixed</p>
<pre><code>
- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()``
instead
of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return
a JSON
object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the
cached value,
so callers pre-populating the cache to avoid a network round-trip could
not
read it back in `[#914 ](https://github.com/jpadilla/pyjwt/issues/914 )
&lt;https://github.com/jpadilla/pyjwt/issues/914&gt ;`__ and
`[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
``fetch_data()`` override that filters or transforms the JWKS is no
longer
undone by the next cache hit in
`[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that
is not
&lt;/tr&gt;&lt;/table&gt;
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> ;
chore: prepare 2.15.0 release</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> ;
fix: make recursive payload tests deterministic</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> ;
fix: normalize recursive JWT payload errors</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> ;
utils: mention bytes in force_bytes type error (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> ;
docs/conf: drop duplicate 'and' from read() docstring (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> ;
Add support for Python 3.15 (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> ;
Catch http.client.HTTPException in PyJWKClient.fetch_data (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> ;
fix: correct docstring typo in _validate_jti (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> ;
docs: clarify JWK certificate member handling (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> ;
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a> ;)</li>
<li>Additional commits viewable in <a
href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0">compare
view</a></li>
</ul>
</details>
<br /></code></pre>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:41:54 -07:00
dependabot[bot]
4217373227
chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph ( #9139 )
...
Bumps [pyjwt](https://github.com/jpadilla/pyjwt ) from 2.14.0 to 2.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases ">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.15.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst ">2.15.0
changelog</a> for complete release details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst ">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.15.0
<https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0> ;</code>__</h2>
<p>Security</p>
<pre><code>
- Wrap recursion errors from deeply nested JWT payloads in
``DecodeError``
instead of exposing a raw ``RecursionError``.
<p>Added</p>
<pre><code>
- Support Python 3.15 by @kytta in
`[#1202 ](https://github.com/jpadilla/pyjwt/issues/1202 )
&lt;https://github.com/jpadilla/pyjwt/pull/1202&gt ;`__
Changed
</code></pre>
<ul>
<li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code>
rather than the raw JWKS
payload, so a cache hit no longer re-parses every key.
<code>JWKSetCache.put()</code>
accepts either form and raises <code>PyJWKSetError</code> for anything
else. As a
result, <code>PyJWKClient.get_jwk_set()</code> returns the same
<code>PyJWKSet</code> instance
for as long as it stays cached, rather than a freshly built one per call
in
<code>[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;</code>__</li>
<li><code>PyJWKClient.fetch_data()</code> now raises
<code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
object&quot;)</code> when
the endpoint response is not a JSON object, instead of returning it for
<code>get_jwk_set()</code> to reject. Callers reaching the JWKS through
<code>get_jwk_set()</code> see the same error as before in
<code>[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;</code>__</li>
</ul>
<p>Fixed</p>
<pre><code>
- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()``
instead
of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return
a JSON
object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the
cached value,
so callers pre-populating the cache to avoid a network round-trip could
not
read it back in `[#914 ](https://github.com/jpadilla/pyjwt/issues/914 )
&lt;https://github.com/jpadilla/pyjwt/issues/914&gt ;`__ and
`[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
``fetch_data()`` override that filters or transforms the JWKS is no
longer
undone by the next cache hit in
`[#1208 ](https://github.com/jpadilla/pyjwt/issues/1208 )
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt ;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that
is not
&lt;/tr&gt;&lt;/table&gt;
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> ;
chore: prepare 2.15.0 release</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> ;
fix: make recursive payload tests deterministic</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> ;
fix: normalize recursive JWT payload errors</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> ;
utils: mention bytes in force_bytes type error (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> ;
docs/conf: drop duplicate 'and' from read() docstring (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> ;
Add support for Python 3.15 (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> ;
Catch http.client.HTTPException in PyJWKClient.fetch_data (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> ;
fix: correct docstring typo in _validate_jti (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> ;
docs: clarify JWK certificate member handling (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a> ;)</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> ;
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a> ;)</li>
<li>Additional commits viewable in <a
href="https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0">compare
view</a></li>
</ul>
</details>
<br /></code></pre>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 11:39:14 -07:00
dependabot[bot]
65ab10f017
chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph ( #9126 )
...
Bumps [pyjwt](https://github.com/jpadilla/pyjwt ) from 2.13.0 to 2.14.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases ">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.14.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst ">2.14.0
changelog</a> for the complete release details and related security
advisories.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst ">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.14.0
<https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0> ;</code>__</h2>
<p>Security</p>
<pre><code>
- Harden HMAC key validation against public-key material supplied as
JWK,
JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
`GHSA-r6x4-923q-g947
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947> ;`__,
`GHSA-ffc3-869f-jxw9
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9> ;`__,
`GHSA-p4g4-x82p-q773
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773> ;`__,
and `GHSA-w2cx-738m-mc7w
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w> ;`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS,
preventing
redirected destinations from being treated as trusted key sources. See
`GHSA-9v7f-9g4p-ffgj
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj> ;`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while
preserving
normal key-rotation behavior. See
`GHSA-2gx3-rcp4-g85q
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q> ;`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught
recursion
errors or whole-set parsing failures. See
`GHSA-8wjv-2p76-3863
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863> ;`__
and `GHSA-w6j9-cwv2-h6wq
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq> ;`__.
- Enforce compact JWS encoding rules during decoding. See
`GHSA-hxm8-2xgr-2p9m
<https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m> ;`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to
`@xclow3n
<https://github.com/xclow3n> ;`__ for reporting this behavior; fixed
in commit
`37b54877
<https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122> ;`__.
<p>Fixed</p>
<pre><code>
- Apply HMAC key validation consistently when keys are loaded through
``PyJWK`` and ``PyJWKClient``. See
`GHSA-pxh4-856f-4h89
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt ;`__.
- Reject empty HMAC keys when represented as JWKs.
See `GHSA-pxh4-856f-4h89
&lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt ;`__.
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df"><code>c6fe464</code></a> ;
release: prepare v2.14.0</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42"><code>f541302</code></a> ;
style: apply Ruff formatting</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"><code>801cd12</code></a> ;
fix: reject public JWK container HMAC keys</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb"><code>af8181c</code></a> ;
fix: reject empty HMAC keys from JWKs</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1"><code>ba4853a</code></a> ;
Throttle repeated PyJWKClient refreshes</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499"><code>2798504</code></a> ;
fix: reject DER public keys as HMAC secrets</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"><code>8b4e233</code></a> ;
fix: reject loader-accepted PEM variants</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258"><code>1f8180a</code></a> ;
fix: format JWS tests</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab"><code>cff1ac5</code></a> ;
Fix redirect handler return annotation</li>
<li><a
href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56"><code>0a795b8</code></a> ;
Reject redirects in PyJWKClient fetches</li>
<li>Additional commits viewable in <a
href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0">compare
view</a></li>
</ul>
</details>
<br /></code></pre>
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 09:53:24 -07:00
Elior Nataf Lackritz and lylelllll
eb69f67b65
fix(checkpoint-sqlite): walk delta ancestors by parent pointer ( #8557 )
...
## Summary
The sqlite delta history silently drops a parent checkpoint whose id sorts above its child's,
losing that parent's stored value and its pending writes. The channel hydrates short with no error.
Fixes #8550
## Problem
Stage 1 walked ancestors with:
```sql
WHERE thread_id = ? AND checkpoint_ns = ? AND checkpoint_id <= ?
ORDER BY checkpoint_id DESC
```
Ancestry is defined by the `parent_checkpoint_id` column. These two predicates add a second
requirement: that every child's id sorts above its parent's. The contract promises monotonic ids,
but that only holds within one process, so ids from processes with different clocks can break it.
When the requirement is violated the parent is excluded from the stream and its seed and writes go
with it. Dropping the range filter alone does not fix it: in `checkpoint_id DESC` order that parent
arrives *before* the target, so the walk streams past it before it has started.
## Fix
A recursive CTE anchored at the target, following `parent_checkpoint_id`:
```sql
WITH RECURSIVE ancestors(checkpoint_id, parent_checkpoint_id, type, checkpoint) AS (
SELECT ... FROM checkpoints
WHERE thread_id = ? AND checkpoint_ns = ? AND checkpoint_id = ?
UNION ALL
SELECT c.... FROM ancestors a CROSS JOIN checkpoints c
ON c.checkpoint_id = a.parent_checkpoint_id
WHERE c.thread_id = ? AND c.checkpoint_ns = ?
)
SELECT checkpoint_id, type, checkpoint FROM ancestors
```
Rows now arrive in walk order (target, parent, grandparent, ...), so `step_walk_with_row` no longer
needs its off-path skip or its `parent_cid` tracking; both are removed. The query reads only true
ancestors, where the old one read every row at or below the target including sibling branches.
`CROSS JOIN` pins the join order. The saver never runs `ANALYZE`, and with a plain `JOIN` sqlite put
`checkpoints` as the outer loop, scanning the whole thread on every recursion step. With `ancestors`
outside, each step is one primary key lookup. Through `get_delta_channel_history`:
| chain length | plain `JOIN` | `CROSS JOIN` |
| -- | -- | -- |
| 1000 | 0.032s | 0.001s |
| 2000 | 0.124s | 0.003s |
| 4000 | 0.475s | 0.006s |
## Cycle guard
Following pointers can loop where a bounded id scan could not, and a loop is reachable through
`put` alone: `put` writes with `INSERT OR REPLACE`, so re-putting an existing checkpoint id under a
descendant's config repoints that checkpoint at its own descendant. The walk stops on a repeated
`checkpoint_id` (one set insert per row, no depth ceiling that could truncate a long migrated
thread). sqlite yields recursive rows lazily, so abandoning the cursor ends the recursion.
`test_walk_terminates_when_put_makes_the_parent_chain_cycle` fails by hanging, not by asserting, if
the guard regresses (confirmed by deleting the guard locally). The package has no `pytest-timeout`,
so the CI job timeout is the backstop.
## Postgres
No equivalent change needed. It pages the whole thread with no id bound and follows parent pointers
in Python, and its upsert never rewrites `parent_checkpoint_id`, so it can neither miss this parent
nor form the loop. `BaseCheckpointSaver` and `InMemorySaver` also walk parent pointers.
## Test plan
New `libs/checkpoint-sqlite/tests/test_delta_parent_walk.py`:
- [x] Sync and async, parametrised over both id orders; the sync case also asserts equality with
`BaseCheckpointSaver` on the same rows. `parent_id_sorts_above_child` is the bug,
`parent_id_sorts_below_child` the control.
- [x] `test_walk_reaches_root_of_long_chain_with_descending_ids`: 40 checkpoints, only stored value
at the root.
- [x] `test_walk_terminates_when_put_makes_the_parent_chain_cycle`.
- [x] `test_walk_step_looks_up_the_parent_by_primary_key`: asserts the recursive step's
`EXPLAIN QUERY PLAN` is a key lookup, so a plain `JOIN` can't come back. Fails with it.
- [x] On `main`: 3 of the 6 walk tests fail (both `parent_id_sorts_above_child` cases and the long
chain). The cycle test passes on `main` too, since the old bounded scan could not loop; it
guards the new path.
- [x] #8550 's repro returns `{'writes': [('task', 'ch', 'write-root')], 'seed': 'seed'}` sync and
async (was `{'writes': []}` on `main`).
- [x] `libs/checkpoint-sqlite`: `make format`, `make lint` clean; full suite 125 passed, 2 skipped.
- [x] `libs/langgraph`: `-k "delta or sqlite"` 739 passed, 1 skipped.
Thanks to @lylelllll for the report, the minimal repro, the base-saver comparison that isolated it
to the fast path, and for suggesting the recursive CTE.
Co-authored-by: lylelllll <59271327+lylelllll@users.noreply.github.com >
2026-09-30 12:17:02 -04:00
Elior Nataf Lackritz and Navneet-Scaler
c0279f0910
fix(checkpoint-postgres): derive the delta walk cursor once the target loads ( #8556 )
...
## Summary
`get_delta_channel_history` on Postgres returns an empty history for any `DeltaChannel` on a
target checkpoint that is not within the first stage-1 pagination page (1024 rows) of the thread.
No exception, no warning: the channel just hydrates empty.
Fixes #8448
## Problem
Stage 1 pages `checkpoints` newest-first from the head of the thread, and after each page
`_try_advance_walks` tries to move every not-yet-seeded channel's walk along the partial
`parent_of` map accumulated so far. The walk starts at the target's parent:
```python
if ch not in walk_cursor_by_ch:
walk_cursor_by_ch[ch] = parent_of.get(target_id)
```
The target can be any checkpoint in the thread, not just the head, so on the first page
`parent_of` frequently has no row for it yet. `.get` then returns `None`, which is also what a
target with no parent returns, and the two are stored identically. Because the initialisation is
guarded by `ch not in walk_cursor_by_ch`, it never runs again: once the walk is parked at `None`
it stays there even after the target's real row and real parent load on a later page.
The result is an empty chain and no seed. Downstream `channels_from_checkpoint` does
```python
replay_ch = delta_spec.from_checkpoint(history.get("seed", MISSING))
replay_ch.replay_writes(history["writes"])
```
so `get_state`, `get_state_history` and `update_state` against an older checkpoint reconstruct a
`messages` channel as `[]` on a thread with hundreds of real messages.
## Fix
Start the walk only once `target_id` is actually present in `parent_of`, so "the target has not
loaded yet" stops sharing a representation with "the target is a root":
```python
if ch not in walk_cursor_by_ch:
if target_id not in parent_of:
continue
walk_cursor_by_ch[ch] = parent_of[target_id]
```
`_try_advance_walks` is a static method on `BasePostgresSaver`, so `PostgresSaver` and
`AsyncPostgresSaver` are both covered by the one change.
## Why it's safe
`continue` leaves the channel exactly as it was, so a later page retries. The three existing
stop conditions are untouched: a channel that finds its seed still seeds, one that reaches a real
root still parks at `None`, and one waiting on an ancestor still keeps its cursor. Paging still
terminates on a short page, which is what ends the run for a target that really is a root.
## Long-term
The sibling sqlite implementation avoids this class of bug differently, by starting its stage-1
scan at the target (`checkpoint_id <= ?`) instead of at the head. Postgres could adopt the same
bound and would then never fetch a checkpoint newer than the target at all, which looks like the
bigger win on a long thread. It makes the read path depend on ancestors always sorting below their
descendants, though, which sqlite already assumes but the Postgres fast path currently does not.
#8550 now reports that assumption as a bug in sqlite, on the grounds that ancestry is defined by
`parent_checkpoint_id` and the contract does not require ids to be monotonic, so the bound is the
wrong direction to move Postgres in. Paging the full thread and following parent pointers is what
keeps this path correct when ids are not monotonic, and with this fix Postgres returns the right
history for #8550 's scenario at every page size.
## Test plan
New `libs/checkpoint-postgres/tests/test_delta_pagination.py`. Page size is monkeypatched rather
than writing 1024+ real checkpoints per case, since the only thing that decides the behaviour is
which page the target lands on.
- [x] `test_async_target_older_than_the_first_page` and its sync twin, parametrised over page
sizes `[_DELTA_PAGE_SIZE, 3, 2, 1]`. The thread has 8 checkpoints with a snapshot at step 1
and the target at step 4, so every size at or below 3 leaves the target off the first page.
The real page size is the control.
- [x] `test_root_target_has_no_history_and_still_terminates` covers the case where a `None` cursor
is the correct answer, at page size 1 so the paging loop runs the length of the thread.
- [x] 6 of the 9 fail on `main` (`expected a snapshot seed, got '<missing>'`); the 3 that pass are
the two controls and the root case.
- [x] `make format`, `make lint_package`, `make lint_tests` clean.
- [x] Full `libs/checkpoint-postgres` suite, rebased on current `main`: 279 passed, 3 skipped on Postgres 16.
- [x] Graph-level repro with `_DELTA_PAGE_SIZE = 5`: 10 invocations, then `get_state` on the 8th-newest
checkpoint returns `[]` on `main` and the full history on this branch.
Thanks to @Navneet-Scaler for the report, the mechanism write-up, and the fix in #8453 , which this
matches.
Co-authored-by: Navneet-Scaler <147032454+Navneet-Scaler@users.noreply.github.com >
2026-09-30 12:16:55 -04:00
ccurme
f5804a5bf5
fix(ci): test locally-built wheel and publish to test pypi after pre-release checks ( #9124 )
2026-09-30 09:30:34 -04:00
John Kennedy and open-swe[bot]
07b33185ea
fix: reject credential-bearing Git dependencies ( #8542 )
...
## Description
Reject Git HTTP dependency URLs containing userinfo before Docker
generation so credentials cannot persist in Dockerfiles or image layers.
Validation now covers local requirement/package metadata and uv
pyproject/lock inputs while keeping errors token-free.
## Test Plan
- [x] Validate credentialed raw, local-manifest, and uv-managed Git URLs
are rejected without echoing secrets
- [x] Validate credential-free HTTPS and SSH Git URLs remain supported
Made by [Open
SWE](https://openswe.vercel.app/agents/81b07455-ece4-3ddc-9955-d7a5bea78d2c )
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-27 21:34:53 +00:00
Hugo DURAND
7daa3ab49d
feat(cli): place self-hosted deployments on a listener ( #9056 )
...
Follow-up to #8482 . `langgraph deploy --push-to` can now create a
deployment in a workspace that
deploys through a listener in the customer's own cluster, which is the
hybrid case. Before this,
creation in such a workspace was impossible from the CLI: the control
plane rejected it and the CLI
told the user to go and create the deployment in the UI first.
## Changes
- Smart Auto-Placement: The CLI now proactively checks your workspace.
If you only have one listener and one Kubernetes namespace configured
(and are using the managed cloud control plane), it automatically routes
your deployment there. No extra flags needed.
- New Disambiguation Flags: If your workspace has multiple listeners or
namespaces, the CLI will ask you to choose. You can now pass
--listener-id and --k8s-namespace to tell it exactly where to deploy.
- Failing Fast: The CLI now validates your listener and namespace
choices before it starts building and pushing the heavy Docker image. If
you provide an invalid ID, it stops immediately instead of wasting your
time and bandwidth.
- Fixed a Duplication Bug: Previously, if you had many deployments with
similar names, a pagination issue could hide your existing deployment
from the CLI, causing it to accidentally create a duplicate. The CLI now
queries the server for the exact deployment name to guarantee this
doesn't happen.
- Cleaner Errors: Error messages from the control plane are now stripped
of their clunky HTTP envelopes so you get clear, readable sentences when
something goes wrong.
## Testing
Deployment on 3 paths, hybrid, self-hosted, nominal
2026-09-23 13:56:01 -04:00
Sreekara Yachamaneni
e868c3ccfd
feat(cli): clarify agent flags and support env defaults ( #9063 )
...
Agent deployment options now print a private-beta notice. Rename
`--environment` to `--agent-environment` and accept `LANGSMITH_AGENT_ID`
/ `LANGSMITH_AGENT_ENVIRONMENT` as process-environment defaults for
deploy and list. Explicit flags take precedence, and the backend payload
is unchanged.
Validation: formatting and lint pass. A local smoke check verified
environment-only deployment, explicit flag precedence, list defaults,
and structured JSON output. Full CLI suite: 411 passed; the two known
Docker failures remain (`test_dockerfile_command_with_docker_compose`
and `test_build_generate_proper_build_context`). No new tests added; the
existing test invocation uses the renamed flag.
2026-09-23 17:53:46 +00:00
bdb85b5aa8
chore: remove Claude-specific instructions ( #9058 )
...
Remove the root `CLAUDE.md` while retaining the shared `AGENTS.md`
instructions. No Claude-specific GitHub workflows are present, so
existing workflows remain unchanged.
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.vercel.app/agents/541e1bd2-e302-582d-b6cf-bd1df1aadda7 )
· openai:gpt-6-astra (low)
Co-authored-by: Mason Daugherty <mdrxy@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-23 00:02:12 -04:00
Sreekara Yachamaneni
1211af45b1
feat(cli): Update langgraph deploy command to use agent_id and environment args ( #9055 )
...
- Accept agent_id and environment args for `lanngraph deploy`
- Validate both arguments present or none
- If agent arguments present, make sure deployment_id and name are not
present
2026-09-22 16:28:36 -04:00
1afaca35a0
feat(cli): add --image-uri flag for self-hosted deployments ( #8482 )
...
Adds `--image-uri <uri>` to `langgraph deploy` so self-hosted LangSmith
customers can build, push, and deploy in one command without needing to
script the three steps manually.
When `--image-uri` is provided the CLI:
- Builds the image tagged to the provided URI (same Docker build path as
the local build flow)
- Pushes using whatever Docker credentials are already in the
environment (e.g. WIF, `aws ecr get-login-password`) — no auth handling
in the CLI
- PATCHes the deployment with `source_revision_config.image_uri` (no
`revision_source`, which the self-hosted control plane rejects for
`external_docker` deployments)
Also fixes two self-hosted-specific issues uncovered during testing:
- `LANGSMITH_ENDPOINT` is now used as a fallback when
`LANGGRAPH_HOST_URL` isn't set — the CLI strips the `/api/v1` path and
appends `/api-host` to reach the control plane
- The httpx client now builds full URLs via string concatenation rather
than relying on httpx base_url merging, which silently dropped the
`/api-host` path prefix when paths started with `/`
- The "Check status at" URL after a deploy now correctly points to the
self-hosted LangSmith UI instead of `smith.langchain.com`
**How did you verify your code works?**
Tested end-to-end against a self-hosted LangSmith instance using ECR as
the registry. `langgraph deploy --image-uri <ecr-uri>` successfully
built, pushed, and triggered a deployment revision. Confirmed the
existing SaaS flow (`langgraph deploy` without `--image-uri`) is
unaffected — the new flag is opt-in and the `LANGSMITH_ENDPOINT`
fallback only activates when `LANGGRAPH_HOST_URL` is unset and
`LANGSMITH_ENDPOINT` is present.
---------
Co-authored-by: Hari Dhanushkodi <hari-dhanushkodi@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
Co-authored-by: Hugo Durand <hugo.durand@langchain.dev >
2026-09-22 11:50:02 -04:00
Elior Nataf Lackritz
49cce0ca85
release(sdk-py): 0.4.5 ( #8988 )
...
Bumps the Python SDK version from 0.4.4 to 0.4.5. Adds `response_schema`
to the `Interrupt` TypedDict (#8886 ).
2026-09-21 10:38:26 -04:00
Elior Nataf Lackritz
19273fa88b
release(langgraph): 1.2.12 ( #8987 )
...
Bumps langgraph from 1.2.11 to 1.2.12. Ships `response_schema` on
`interrupt()` (#8886 ).
2026-09-21 10:38:21 -04:00
John Kennedy and open-swe[bot]
ed384f3a12
fix(cli): remediate AnyIO vulnerabilities in example lockfiles ( #9022 )
...
- Upgrade AnyIO from 4.13.0 to 4.14.2 in both uv example lockfiles,
fixing GHSA-82r6-8w77-94w6 (TLS certificate spoofing) and
GHSA-5p39-cfhj-2xmp (process-pool hangs).
- Remove the orphaned examples Poetry lockfile left behind by the uv
migration; current example tooling does not consume it.
- Addresses all six currently open Dependabot alerts without changing
unrelated dependencies.
Made by [Open SWE](https://github.com/langchain-ai/open-swe ) · [view
thread](https://openswe.vercel.app/agents/37d08f4f-9fe6-51be-adc9-d58aa9e6e010 )
· openai:gpt-6-astra (medium)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-20 12:50:31 -07:00
dependabot[bot]
aa742fb31e
chore(deps): bump anyio from 4.14.2 to 4.15.1 in /libs/sdk-py ( #8997 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.14.2 to 4.15.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.15.1</h2>
<ul>
<li>Implemented a compatibility fix for supporting direct access of
<code>anyio.*</code> submodules from the main package even when those
submodules were not directly imported first (<!-- raw HTML omitted --><a
href="https://redirect.github.com/agronholm/anyio/issues/1311 ">#1311</a>
<<a
href="https://redirect.github.com/agronholm/anyio/issues/1311%5C%3E ">agronholm/anyio#1311</a><!--
raw HTML omitted -->)</li>
</ul>
<h2>4.15.0</h2>
<ul>
<li>
<p>Added support for the newer keyword-only arguments on
<code>anyio.Path</code> methods to match the standard library
<code>pathlib.Path</code>:</p>
<ul>
<li><code>follow_symlinks</code> on <code>exists()</code> (Python
3.12+)</li>
<li><code>follow_symlinks</code> on <code>is_dir()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>is_file()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>owner()</code> (Python
3.13+)</li>
<li><code>follow_symlinks</code> on <code>group()</code> (Python
3.13+)</li>
<li><code>newline</code> on <code>read_text()</code> (Python 3.13+)</li>
</ul>
<p>(<a
href="https://redirect.github.com/agronholm/anyio/pull/1286 ">#1286</a>,
<a
href="https://redirect.github.com/agronholm/anyio/pull/1293 ">#1293</a>;
PR by <a
href="https://github.com/jaideeppyne "><code>@jaideeppyne</code></a>)</p>
</li>
<li>
<p>Added <code>amap</code>, <code>gather</code>, and
<code>as_completed</code> utility functions to simplify common patterns
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1173 ">#1173</a>;
PR by <a
href="https://github.com/Graeme22 "><code>@Graeme22</code></a>)</p>
</li>
<li>
<p>Added <code>--anyio-mode</code> command-line option as an alternative
to the <code>anyio_mode</code> ini setting, and fix the pytest plugin's
auto mode detection to recognize the mode when set via either
mechanism(e.g: <code>pytest_asyncio</code>). (<a
href="https://redirect.github.com/agronholm/anyio/pull/1242 ">#1242</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Added the <code>anyio.Future</code> synchronization primitive which
behaves similar to <code>asyncio.Future</code>, allowing tasks to wait
for a value (or exception) from another task (<a
href="https://redirect.github.com/agronholm/anyio/pull/1146 ">#1146</a>;
PR by <a
href="https://github.com/Vizonex "><code>@Vizonex</code></a>)</p>
</li>
<li>
<p>Added guidance for managing multiple memory object stream producers
and consumers with cloned streams (<a
href="https://redirect.github.com/agronholm/anyio/issues/330 ">#330</a>;
PR by <a
href="https://github.com/nightcityblade "><code>@nightcityblade</code></a>)</p>
</li>
<li>
<p>Added <code>StapledObjectStream.send_nowait()</code> that delegates
to the underlying <code>ObjectSendStream</code>, if it implements it (<a
href="https://redirect.github.com/agronholm/anyio/pull/1241 ">#1241</a>;
PR by <a
href="https://github.com/davidbrochart "><code>@davidbrochart</code></a>)</p>
</li>
<li>
<p>Added the <code>move_on_at()</code> and <code>fail_at()</code>
functions to complement <code>move_on_after()</code> and
<code>fail_after()</code></p>
</li>
<li>
<p>Changed the default name for a task spawned with
<code>TaskGroup.create_task(func())</code> to match the default task
name for the analogous task spawned with
<code>TaskGroup.start_soon(func)</code> or
<code>TaskGroup.start(func)</code> in more situations. Previously, the
default name of a <code>TaskGroup.create_task</code> task never included
the module name. (The default name for a task spawned with
<code>TaskGroup.start_soon</code> or <code>TaskGroup.start</code>
typically includes the module name.) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1234 ">#1234</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed the <code>anyio</code> and <code>anyio.abc</code> modules to
lazily (much like <code>810</code>) import the necessary submodules.
This is done by parsing the AST of the module and building a lookup
table from the <code>if TYPE_CHECKING:</code> block. A fallback mode has
been provided for installations where the source code is unavailable
(e.g. PyInstaller). (<a
href="https://redirect.github.com/agronholm/anyio/pull/1169 ">#1169</a>)</p>
</li>
<li>
<p>Fixed free-threading compatibility issues arising from the fact that
on Python 3.14 free-threading builds, newly created threads inherit the
current context by default, causing AnyIO to behave erroneously in
relation to <code>start_blocking_portal()</code> and
<code>anyio.to_thread.run_sync()</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1224 ">#1224</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Fixed <code>SpooledTemporaryFile.readinto()</code> and
<code>readinto1()</code> reading twice before rollover, so the
destination buffer was overwritten by the second read and the file
position advanced twice, silently losing data (<a
href="https://redirect.github.com/agronholm/anyio/pull/1215 ">#1215</a>;
PR by <a
href="https://github.com/c-tonneslan "><code>@c-tonneslan</code></a>)</p>
</li>
<li>
<p>Added a <code>reason</code> parameter to <code>fail_after</code> (and
the new <code>fail_at</code>) allowing for added exception context when
raising <code>TimeoutError</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1227 ">#1227</a>;
PR by <a
href="https://github.com/Graeme22 "><code>@Graeme22</code></a>)</p>
</li>
<li>
<p>Fixed the default <code>TaskHandle.name</code> missing part of the
task name for tasks started with <code>TaskGroup.start</code> on Trio
(<a
href="https://redirect.github.com/agronholm/anyio/issues/1231 ">#1231</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.run</code> leaking, or at least, delaying
collection of loop and root_task due to the root task being cached in a
<code>RunVar</code>. (<a
href="https://redirect.github.com/agronholm/anyio/issues/1203 ">#1203</a>;
PR by <a
href="https://github.com/tapetersen "><code>@tapetersen</code></a>)</p>
</li>
<li>
<p>Fixed <code>anyio.Path.with_stem()</code> silently producing a wrong
path (e.g. <code>Path(".txt")</code>) instead of raising
<code>ValueError</code> when given an empty stem on a path with a
non-empty suffix, unlike <code>pathlib.PurePath.with_stem</code> (<a
href="https://redirect.github.com/agronholm/anyio/pull/1200 ">#1200</a>;
PR by <a
href="https://github.com/Sanjays2402 "><code>@Sanjays2402</code></a>)</p>
</li>
<li>
<p>Fixed <code>UNIXSocketStream.aclose()</code> raising
<code>asyncio.InvalidStateError</code> when a concurrent receive or send
operation had just been cancelled on the asyncio backend (<a
href="https://redirect.github.com/agronholm/anyio/issues/1267 ">#1267</a>;
PR by <a
href="https://github.com/alloutflo "><code>@alloutflo</code></a>)</p>
</li>
<li>
<p>Fixed the pytest plugin importing the deprecated
<code>_pytest.python.CallSpec2</code> alias, which triggers
<code>PytestRemovedIn10Warning</code> on <code>pytest>=9.2</code> and
crashes pytest at startup when <code>filterwarnings = error</code> is
configured (<a
href="https://redirect.github.com/agronholm/anyio/issues/1271 ">#1271</a>;
PR by <a
href="https://github.com/matthewfeickert "><code>@matthewfeickert</code></a>)</p>
</li>
<li>
<p>Fixed an asyncio worker thread race that could raise
<code>RuntimeError</code> when the event loop closed between checking
its state and scheduling the worker result (<a
href="https://redirect.github.com/agronholm/anyio/issues/1265 ">#1265</a>;
PR by <a
href="https://github.com/hansu650 "><code>@hansu650</code></a>)</p>
</li>
<li>
<p>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens when <code>total_tokens</code> was raised while the
limiter was over-subscribed (<a
href="https://redirect.github.com/agronholm/anyio/pull/1223 ">#1223</a>;
PR by <a
href="https://github.com/zelinewang "><code>@zelinewang</code></a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/ffcd1542cd6d127980205f90a0100078849dd703 "><code>ffcd154</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/0ecf5ed98d294242509b043ebd1a0843e52d892f "><code>0ecf5ed</code></a>
Added a workaround for third party code accessing unimported submodules
(<a
href="https://redirect.github.com/agronholm/anyio/issues/1309 ">#1309</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/928366259543412a2deb1e2ba09ea45ffa92ef4f "><code>9283662</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/d137692a90f76e4f71605e32ea5ca94cab3a539d "><code>d137692</code></a>
Improved the instructions for AI agents</li>
<li><a
href="https://github.com/agronholm/anyio/commit/033fc52b8fa8e90c5d0ef24b10b3860e974a6265 "><code>033fc52</code></a>
Shield TemporaryDirectory cleanup from cancellation (<a
href="https://redirect.github.com/agronholm/anyio/issues/1304 ">#1304</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/942e9a6552cc10b5aaa779d84bfc8e2c3d5fcffc "><code>942e9a6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/agronholm/anyio/issues/1305 ">#1305</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/b825c3be7cb4ca1a8000b8065d4e147843deb704 "><code>b825c3b</code></a>
Fixed pyproject.toml changes not triggering the test suite</li>
<li><a
href="https://github.com/agronholm/anyio/commit/9727dc504681e2986b5bc285de9571fb467539af "><code>9727dc5</code></a>
Fixed start inconsistencies between trio and asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1198 ">#1198</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/b05fe6d160a640355c201363cab286a7d2581da8 "><code>b05fe6d</code></a>
Fixed wrong type in move_on_after (<a
href="https://redirect.github.com/agronholm/anyio/issues/1297 ">#1297</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44d0c93cc20079acbf38ba4dbed5ab9df323f153 "><code>44d0c93</code></a>
Fixed asyncio task group coroutine cleanup (<a
href="https://redirect.github.com/agronholm/anyio/issues/1275 ">#1275</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.14.2...4.15.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 23:31:43 +00:00
dependabot[bot]
b58044ac7a
chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/cli ( #8998 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.13.0 to 4.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
<h2>4.14.1</h2>
<ul>
<li>Fixed teardown of higher-scoped async fixtures failing on asyncio
with <code>RuntimeError: Attempted to exit cancel scope in a different
task than it was entered in</code> when an async test raise an outcome
exception (e.g., <code>pytest.skip()</code>,
<code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a
href="https://redirect.github.com/agronholm/anyio/issues/1179 ">#1179</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of
<code>0</code> when the limiter was instantiated outside of an event
loop, contradicting the documented behavior of allowing 0 total tokens
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1183 ">#1183</a>;
PR by <a
href="https://github.com/nyxst4ck "><code>@nyxst4ck</code></a>)</li>
</ul>
<h2>4.14.0</h2>
<ul>
<li>
<p>Added support for Python 3.15</p>
</li>
<li>
<p>Added an asynchronous implementation of the <code>itertools</code>
module (<a
href="https://redirect.github.com/agronholm/anyio/issues/998 ">#998</a>;
PR by <a href="https://github.com/11kkw "><code>@11kkw</code></a>)</p>
</li>
<li>
<p>Added the <code>local_port</code> parameter to
<code>connect_tcp()</code> to allow binding to a specific local port
before connecting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1067 ">#1067</a>;
PR by <a
href="https://github.com/nullwiz "><code>@nullwiz</code></a>)</p>
</li>
<li>
<p>Added support for custom capacity limiters in async path and file I/O
functions and classes</p>
</li>
<li>
<p>Added the <code>create_task()</code> task group method for easier
asyncio migration (returns a <code>TaskHandle</code>) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1098 ">#1098</a>)</p>
</li>
<li>
<p>Changed <code>TaskGroup.start_soon()</code> to return a
<code>TaskHandle</code></p>
</li>
<li>
<p>Added an option for <code>TaskGroup.start()</code> to return a
<code>TaskHandle</code> (which then contains the start value in the
<code>start_value</code> property)</p>
</li>
<li>
<p>Added the <code>cancel()</code> convenience method to
<code>TaskGroup</code> as a shortcut for cancelling the task group's
cancel scope</p>
</li>
<li>
<p>Improved the error message when a known backend is not installed to
suggest the install command (<a
href="https://redirect.github.com/agronholm/anyio/pull/1115 ">#1115</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Improved <code>anyio.Path</code> to preserve subclass types by
returning <code>Self</code> in methods that return path objects (<a
href="https://redirect.github.com/agronholm/anyio/issues/1130 ">#1130</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Changed the parameter type annotation in
<code>anyio.Path.write_bytes()</code> to accept any
<code>ReadableBuffer</code>, thus allowing it to accept
<code>bytearray</code> and <code>memoryview</code> to match
<code>pathlib.Path.write_bytes()</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1135 ">#1135</a>;
PR by <a href="https://github.com/SAY-5 "><code>@SAY-5</code></a>)</p>
</li>
<li>
<p>Changed several type annotations to only accept callables returning
coroutine-like objects instead of arbitrary awaitables:</p>
<ul>
<li><code>TaskGroup.start_soon()</code></li>
<li><code>TaskGroup.start()</code></li>
<li><code>anyio.from_thread.run()</code></li>
</ul>
<p>This reverts an earlier change from v3.7.0 which was made in error.
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1153 ">#1153</a>)</p>
</li>
<li>
<p>Changed <code>anyio.run</code> to support callables returning
arbitrary awaitables at runtime on all backends. Previously, this only
worked on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/pull/1171 ">#1171</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed several classes (and their subclasses) to have
<code>__slots__</code> (with <code>__weakref__</code>):</p>
<ul>
<li><code>anyio.CancelScope</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.13.0...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 23:29:43 +00:00
dependabot[bot]
daa514a988
chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/checkpoint-conformance ( #8996 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.13.0 to 4.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
<h2>4.14.1</h2>
<ul>
<li>Fixed teardown of higher-scoped async fixtures failing on asyncio
with <code>RuntimeError: Attempted to exit cancel scope in a different
task than it was entered in</code> when an async test raise an outcome
exception (e.g., <code>pytest.skip()</code>,
<code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a
href="https://redirect.github.com/agronholm/anyio/issues/1179 ">#1179</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of
<code>0</code> when the limiter was instantiated outside of an event
loop, contradicting the documented behavior of allowing 0 total tokens
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1183 ">#1183</a>;
PR by <a
href="https://github.com/nyxst4ck "><code>@nyxst4ck</code></a>)</li>
</ul>
<h2>4.14.0</h2>
<ul>
<li>
<p>Added support for Python 3.15</p>
</li>
<li>
<p>Added an asynchronous implementation of the <code>itertools</code>
module (<a
href="https://redirect.github.com/agronholm/anyio/issues/998 ">#998</a>;
PR by <a href="https://github.com/11kkw "><code>@11kkw</code></a>)</p>
</li>
<li>
<p>Added the <code>local_port</code> parameter to
<code>connect_tcp()</code> to allow binding to a specific local port
before connecting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1067 ">#1067</a>;
PR by <a
href="https://github.com/nullwiz "><code>@nullwiz</code></a>)</p>
</li>
<li>
<p>Added support for custom capacity limiters in async path and file I/O
functions and classes</p>
</li>
<li>
<p>Added the <code>create_task()</code> task group method for easier
asyncio migration (returns a <code>TaskHandle</code>) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1098 ">#1098</a>)</p>
</li>
<li>
<p>Changed <code>TaskGroup.start_soon()</code> to return a
<code>TaskHandle</code></p>
</li>
<li>
<p>Added an option for <code>TaskGroup.start()</code> to return a
<code>TaskHandle</code> (which then contains the start value in the
<code>start_value</code> property)</p>
</li>
<li>
<p>Added the <code>cancel()</code> convenience method to
<code>TaskGroup</code> as a shortcut for cancelling the task group's
cancel scope</p>
</li>
<li>
<p>Improved the error message when a known backend is not installed to
suggest the install command (<a
href="https://redirect.github.com/agronholm/anyio/pull/1115 ">#1115</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Improved <code>anyio.Path</code> to preserve subclass types by
returning <code>Self</code> in methods that return path objects (<a
href="https://redirect.github.com/agronholm/anyio/issues/1130 ">#1130</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Changed the parameter type annotation in
<code>anyio.Path.write_bytes()</code> to accept any
<code>ReadableBuffer</code>, thus allowing it to accept
<code>bytearray</code> and <code>memoryview</code> to match
<code>pathlib.Path.write_bytes()</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1135 ">#1135</a>;
PR by <a href="https://github.com/SAY-5 "><code>@SAY-5</code></a>)</p>
</li>
<li>
<p>Changed several type annotations to only accept callables returning
coroutine-like objects instead of arbitrary awaitables:</p>
<ul>
<li><code>TaskGroup.start_soon()</code></li>
<li><code>TaskGroup.start()</code></li>
<li><code>anyio.from_thread.run()</code></li>
</ul>
<p>This reverts an earlier change from v3.7.0 which was made in error.
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1153 ">#1153</a>)</p>
</li>
<li>
<p>Changed <code>anyio.run</code> to support callables returning
arbitrary awaitables at runtime on all backends. Previously, this only
worked on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/pull/1171 ">#1171</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed several classes (and their subclasses) to have
<code>__slots__</code> (with <code>__weakref__</code>):</p>
<ul>
<li><code>anyio.CancelScope</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.13.0...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 15:36:37 -07:00
dependabot[bot]
022043a679
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint ( #8995 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.12.1 to 4.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
<h2>4.14.1</h2>
<ul>
<li>Fixed teardown of higher-scoped async fixtures failing on asyncio
with <code>RuntimeError: Attempted to exit cancel scope in a different
task than it was entered in</code> when an async test raise an outcome
exception (e.g., <code>pytest.skip()</code>,
<code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a
href="https://redirect.github.com/agronholm/anyio/issues/1179 ">#1179</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of
<code>0</code> when the limiter was instantiated outside of an event
loop, contradicting the documented behavior of allowing 0 total tokens
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1183 ">#1183</a>;
PR by <a
href="https://github.com/nyxst4ck "><code>@nyxst4ck</code></a>)</li>
</ul>
<h2>4.14.0</h2>
<ul>
<li>
<p>Added support for Python 3.15</p>
</li>
<li>
<p>Added an asynchronous implementation of the <code>itertools</code>
module (<a
href="https://redirect.github.com/agronholm/anyio/issues/998 ">#998</a>;
PR by <a href="https://github.com/11kkw "><code>@11kkw</code></a>)</p>
</li>
<li>
<p>Added the <code>local_port</code> parameter to
<code>connect_tcp()</code> to allow binding to a specific local port
before connecting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1067 ">#1067</a>;
PR by <a
href="https://github.com/nullwiz "><code>@nullwiz</code></a>)</p>
</li>
<li>
<p>Added support for custom capacity limiters in async path and file I/O
functions and classes</p>
</li>
<li>
<p>Added the <code>create_task()</code> task group method for easier
asyncio migration (returns a <code>TaskHandle</code>) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1098 ">#1098</a>)</p>
</li>
<li>
<p>Changed <code>TaskGroup.start_soon()</code> to return a
<code>TaskHandle</code></p>
</li>
<li>
<p>Added an option for <code>TaskGroup.start()</code> to return a
<code>TaskHandle</code> (which then contains the start value in the
<code>start_value</code> property)</p>
</li>
<li>
<p>Added the <code>cancel()</code> convenience method to
<code>TaskGroup</code> as a shortcut for cancelling the task group's
cancel scope</p>
</li>
<li>
<p>Improved the error message when a known backend is not installed to
suggest the install command (<a
href="https://redirect.github.com/agronholm/anyio/pull/1115 ">#1115</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Improved <code>anyio.Path</code> to preserve subclass types by
returning <code>Self</code> in methods that return path objects (<a
href="https://redirect.github.com/agronholm/anyio/issues/1130 ">#1130</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Changed the parameter type annotation in
<code>anyio.Path.write_bytes()</code> to accept any
<code>ReadableBuffer</code>, thus allowing it to accept
<code>bytearray</code> and <code>memoryview</code> to match
<code>pathlib.Path.write_bytes()</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1135 ">#1135</a>;
PR by <a href="https://github.com/SAY-5 "><code>@SAY-5</code></a>)</p>
</li>
<li>
<p>Changed several type annotations to only accept callables returning
coroutine-like objects instead of arbitrary awaitables:</p>
<ul>
<li><code>TaskGroup.start_soon()</code></li>
<li><code>TaskGroup.start()</code></li>
<li><code>anyio.from_thread.run()</code></li>
</ul>
<p>This reverts an earlier change from v3.7.0 which was made in error.
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1153 ">#1153</a>)</p>
</li>
<li>
<p>Changed <code>anyio.run</code> to support callables returning
arbitrary awaitables at runtime on all backends. Previously, this only
worked on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/pull/1171 ">#1171</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed several classes (and their subclasses) to have
<code>__slots__</code> (with <code>__weakref__</code>):</p>
<ul>
<li><code>anyio.CancelScope</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 15:24:38 -07:00
dependabot[bot]
d7b99cc3ab
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/sdk-py ( #8994 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.12.1 to 4.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
<h2>4.14.1</h2>
<ul>
<li>Fixed teardown of higher-scoped async fixtures failing on asyncio
with <code>RuntimeError: Attempted to exit cancel scope in a different
task than it was entered in</code> when an async test raise an outcome
exception (e.g., <code>pytest.skip()</code>,
<code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a
href="https://redirect.github.com/agronholm/anyio/issues/1179 ">#1179</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of
<code>0</code> when the limiter was instantiated outside of an event
loop, contradicting the documented behavior of allowing 0 total tokens
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1183 ">#1183</a>;
PR by <a
href="https://github.com/nyxst4ck "><code>@nyxst4ck</code></a>)</li>
</ul>
<h2>4.14.0</h2>
<ul>
<li>
<p>Added support for Python 3.15</p>
</li>
<li>
<p>Added an asynchronous implementation of the <code>itertools</code>
module (<a
href="https://redirect.github.com/agronholm/anyio/issues/998 ">#998</a>;
PR by <a href="https://github.com/11kkw "><code>@11kkw</code></a>)</p>
</li>
<li>
<p>Added the <code>local_port</code> parameter to
<code>connect_tcp()</code> to allow binding to a specific local port
before connecting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1067 ">#1067</a>;
PR by <a
href="https://github.com/nullwiz "><code>@nullwiz</code></a>)</p>
</li>
<li>
<p>Added support for custom capacity limiters in async path and file I/O
functions and classes</p>
</li>
<li>
<p>Added the <code>create_task()</code> task group method for easier
asyncio migration (returns a <code>TaskHandle</code>) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1098 ">#1098</a>)</p>
</li>
<li>
<p>Changed <code>TaskGroup.start_soon()</code> to return a
<code>TaskHandle</code></p>
</li>
<li>
<p>Added an option for <code>TaskGroup.start()</code> to return a
<code>TaskHandle</code> (which then contains the start value in the
<code>start_value</code> property)</p>
</li>
<li>
<p>Added the <code>cancel()</code> convenience method to
<code>TaskGroup</code> as a shortcut for cancelling the task group's
cancel scope</p>
</li>
<li>
<p>Improved the error message when a known backend is not installed to
suggest the install command (<a
href="https://redirect.github.com/agronholm/anyio/pull/1115 ">#1115</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Improved <code>anyio.Path</code> to preserve subclass types by
returning <code>Self</code> in methods that return path objects (<a
href="https://redirect.github.com/agronholm/anyio/issues/1130 ">#1130</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Changed the parameter type annotation in
<code>anyio.Path.write_bytes()</code> to accept any
<code>ReadableBuffer</code>, thus allowing it to accept
<code>bytearray</code> and <code>memoryview</code> to match
<code>pathlib.Path.write_bytes()</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1135 ">#1135</a>;
PR by <a href="https://github.com/SAY-5 "><code>@SAY-5</code></a>)</p>
</li>
<li>
<p>Changed several type annotations to only accept callables returning
coroutine-like objects instead of arbitrary awaitables:</p>
<ul>
<li><code>TaskGroup.start_soon()</code></li>
<li><code>TaskGroup.start()</code></li>
<li><code>anyio.from_thread.run()</code></li>
</ul>
<p>This reverts an earlier change from v3.7.0 which was made in error.
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1153 ">#1153</a>)</p>
</li>
<li>
<p>Changed <code>anyio.run</code> to support callables returning
arbitrary awaitables at runtime on all backends. Previously, this only
worked on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/pull/1171 ">#1171</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed several classes (and their subclasses) to have
<code>__slots__</code> (with <code>__weakref__</code>):</p>
<ul>
<li><code>anyio.CancelScope</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 15:24:34 -07:00
dependabot[bot]
b19edd783b
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint-sqlite ( #8993 )
...
Bumps [anyio](https://github.com/agronholm/anyio ) from 4.12.1 to 4.14.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
<h2>4.14.1</h2>
<ul>
<li>Fixed teardown of higher-scoped async fixtures failing on asyncio
with <code>RuntimeError: Attempted to exit cancel scope in a different
task than it was entered in</code> when an async test raise an outcome
exception (e.g., <code>pytest.skip()</code>,
<code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a
href="https://redirect.github.com/agronholm/anyio/issues/1179 ">#1179</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of
<code>0</code> when the limiter was instantiated outside of an event
loop, contradicting the documented behavior of allowing 0 total tokens
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1183 ">#1183</a>;
PR by <a
href="https://github.com/nyxst4ck "><code>@nyxst4ck</code></a>)</li>
</ul>
<h2>4.14.0</h2>
<ul>
<li>
<p>Added support for Python 3.15</p>
</li>
<li>
<p>Added an asynchronous implementation of the <code>itertools</code>
module (<a
href="https://redirect.github.com/agronholm/anyio/issues/998 ">#998</a>;
PR by <a href="https://github.com/11kkw "><code>@11kkw</code></a>)</p>
</li>
<li>
<p>Added the <code>local_port</code> parameter to
<code>connect_tcp()</code> to allow binding to a specific local port
before connecting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1067 ">#1067</a>;
PR by <a
href="https://github.com/nullwiz "><code>@nullwiz</code></a>)</p>
</li>
<li>
<p>Added support for custom capacity limiters in async path and file I/O
functions and classes</p>
</li>
<li>
<p>Added the <code>create_task()</code> task group method for easier
asyncio migration (returns a <code>TaskHandle</code>) (<a
href="https://redirect.github.com/agronholm/anyio/pull/1098 ">#1098</a>)</p>
</li>
<li>
<p>Changed <code>TaskGroup.start_soon()</code> to return a
<code>TaskHandle</code></p>
</li>
<li>
<p>Added an option for <code>TaskGroup.start()</code> to return a
<code>TaskHandle</code> (which then contains the start value in the
<code>start_value</code> property)</p>
</li>
<li>
<p>Added the <code>cancel()</code> convenience method to
<code>TaskGroup</code> as a shortcut for cancelling the task group's
cancel scope</p>
</li>
<li>
<p>Improved the error message when a known backend is not installed to
suggest the install command (<a
href="https://redirect.github.com/agronholm/anyio/pull/1115 ">#1115</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Improved <code>anyio.Path</code> to preserve subclass types by
returning <code>Self</code> in methods that return path objects (<a
href="https://redirect.github.com/agronholm/anyio/issues/1130 ">#1130</a>;
PR by <a
href="https://github.com/EmmanuelNiyonshuti "><code>@EmmanuelNiyonshuti</code></a>)</p>
</li>
<li>
<p>Changed the parameter type annotation in
<code>anyio.Path.write_bytes()</code> to accept any
<code>ReadableBuffer</code>, thus allowing it to accept
<code>bytearray</code> and <code>memoryview</code> to match
<code>pathlib.Path.write_bytes()</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1135 ">#1135</a>;
PR by <a href="https://github.com/SAY-5 "><code>@SAY-5</code></a>)</p>
</li>
<li>
<p>Changed several type annotations to only accept callables returning
coroutine-like objects instead of arbitrary awaitables:</p>
<ul>
<li><code>TaskGroup.start_soon()</code></li>
<li><code>TaskGroup.start()</code></li>
<li><code>anyio.from_thread.run()</code></li>
</ul>
<p>This reverts an earlier change from v3.7.0 which was made in error.
(<a
href="https://redirect.github.com/agronholm/anyio/pull/1153 ">#1153</a>)</p>
</li>
<li>
<p>Changed <code>anyio.run</code> to support callables returning
arbitrary awaitables at runtime on all backends. Previously, this only
worked on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/pull/1171 ">#1171</a>;
PR by <a
href="https://github.com/gschaffner "><code>@gschaffner</code></a>)</p>
</li>
<li>
<p>Changed several classes (and their subclasses) to have
<code>__slots__</code> (with <code>__weakref__</code>):</p>
<ul>
<li><code>anyio.CancelScope</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-18 15:24:12 -07:00
dependabot[bot]
c81c13533e
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph ( #8958 )
...
Bumps [soupsieve](https://github.com/facelessuser/soupsieve ) from 2.8.4
to 2.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facelessuser/soupsieve/releases ">soupsieve's
releases</a>.</em></p>
<blockquote>
<h2>2.9</h2>
<ul>
<li><strong>NEW</strong>: Drop Python 3.9 support.</li>
<li><strong>NEW</strong>: Lazy compile selector patterns to improve
initial import speed.</li>
<li><strong>FIX</strong>: Correct
<code>:nth-child</code>/<code>:nth-of-type</code> (and
<code>-last-</code> variants) for <code>An+B</code> values whose
sequence steps onto
index 0 or onto the last child (e.g. <code>:nth-child(2n-2)</code>,
<code>:nth-child(n-1)</code>, <code>:nth-child(n+5)</code>), which
previously
matched the wrong elements or nothing at all (<a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>).</li>
<li><strong>FIX</strong>: More efficient CSS ID matching (<a
href="https://github.com/kaimandalic "><code>@kaimandalic</code></a>).</li>
<li><strong>FIX</strong>: Fix inefficient trimming of comments and white
space (<a
href="https://github.com/kaimandalic "><code>@kaimandalic</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/8763f914472fc83652babda708bed5c8ef287004 "><code>8763f91</code></a>
Format changelog message</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda "><code>cf198fc</code></a>
Fix inefficient trimming of comments and white space</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef "><code>ce44e49</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/751c57b2c7e978e206b94b7dba17f8e2af392e19 "><code>751c57b</code></a>
Fix :nth-child/:nth-of-type matching for An+B index boundaries (<a
href="https://redirect.github.com/facelessuser/soupsieve/issues/297 ">#297</a>)</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/08e9ede4dcfafef860155319ef5eb9708e75d10b "><code>08e9ede</code></a>
Drop Python 3.9</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/d6e68303a6c3e0e410530939b92955ba24a07a81 "><code>d6e6830</code></a>
Rework selector mapping</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/d2d1581fe275f89cb2e792589fed770aeb9e99b3 "><code>d2d1581</code></a>
Utilize property for accessing lazy regular expression pattern</li>
<li><a
href="https://github.com/facelessuser/soupsieve/commit/b8701dec25c84a3910fd9a03222a3804fa119a1d "><code>b8701de</code></a>
Build patterns and regexes lazily in css_parser (<a
href="https://redirect.github.com/facelessuser/soupsieve/issues/296 ">#296</a>)</li>
<li>See full diff in <a
href="https://github.com/facelessuser/soupsieve/compare/2.8.4...2.9 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-17 20:18:46 -07:00
Elior Nataf Lackritz
448a763779
feat(langgraph): add response_schema to interrupt() ( #8886 )
...
Adds an optional keyword-only `response_schema` to `interrupt()`,
carried on `Interrupt.response_schema` as JSON Schema so clients
(LangGraph Studio first) can render a typed form for the resume value
instead of a free-form JSON box. Default `None`, so nothing changes for
existing graphs.
- Accepts a JSON Schema dict (passed through, not validated) or a
Pydantic model / `TypedDict` / dataclass, converted with
`TypeAdapter.json_schema()`. For those, the resume value is validated
and the validated object is what `interrupt()` returns; an invalid value
raises from the node before it is committed, so the next resume works.
- Additive on the `stream_mode="debug"` payload: interrupt dicts gain
`response_schema` (it is a dataclass field, serialized with `asdict`).
- `libs/sdk-py`: mirrors the field on the `Interrupt` TypedDict as
`NotRequired`; the server omits the key when no schema was given.
JS counterpart: langchain-ai/langgraphjs#2824 .
Verified: new tests parametrized across every checkpointer backend
(schema kinds, coercion, invalid resume) plus the full `libs/langgraph`
suite and downstream `prebuilt`, `cli`, `sdk-py`; round-tripped end to
end through the agent server with this branch installed.
2026-09-17 11:33:37 -04:00
Lauren Hirata Singh
230927fb3a
docs: publish the generated llms.txt instead of a hand-written copy ( #8922 )
...
## Why
`docs/llms.txt` is written by hand and was last touched in February, so
the index served at <https://langchain-ai.github.io/langgraph/llms.txt >
had drifted badly:
- 12 pages listed, against the 43 the docs site publishes.
- One entry, `/oss/python/langgraph/why-langgraph`, now 404s.
The deploy workflow only fires on `docs/**` pushes, so nothing brought
the file back in line as the docs site changed. It is served verbatim:
`generate_redirects.py` copies it into `docs/_site` via a `static_files`
list, and `deploy-redirects.yml` uploads that directory to Pages.
The docs site already generates exactly this index, and regenerates it
on every deploy:
```
https://docs.langchain.com/oss/python/langgraph/llms.txt
```
## What changed
`generate_redirects.py` now fetches that index at build time and writes
it into `_site`, so the published file cannot drift from the docs site.
The committed `docs/llms.txt` stays as a fallback only, refreshed here
to current content.
`deploy-redirects.yml` gains a weekly `schedule:` trigger, so docs
changes that never touch this repo still reach the deployed file. The
`permissions:` block is unchanged.
## Fetching remote content in CI
The fetched body is published on a public Pages site, so it is validated
before it is written:
- The URL is a hardcoded module constant, never built from input.
- Both that URL and the post-redirect `response.url` are checked against
an HTTPS-plus-single-host allowlist. `urlopen` follows redirects, so
checking only the request URL would not be enough.
- 30 second timeout, response capped at 1MB, decoded as UTF-8.
- The body must open with a markdown heading and contain a
docs.langchain.com link, which rejects an error page or a truncated
response.
Any failure returns `None` and falls back to the committed copy, so a
docs.langchain.com outage degrades to a stale file rather than a broken
deploy or a published error page.
## Verification
Ran `python docs/generate_redirects.py`: 294 redirect files, `llms.txt`
fetched, 43 entries.
Each rejection path was exercised against a stubbed `urlopen` and all
fall back to the committed file:
| Case | Result |
|---|---|
| Network error | falls back |
| Timeout | falls back |
| Redirect to another host | falls back |
| Body over 1MB | falls back |
| Invalid UTF-8 | falls back |
| HTML error page | falls back |
| Empty body | falls back |
| Valid index | published |
Allowlist rejects `http://docs.langchain.com/ ...`,
`https://evil.com/ ...`, and `https://docs.langchain.com.evil.com/ ...`.
## Note on ordering
The fallback committed here is labelled "LangGraph (Python)", which is
what the docs site will serve once langchain-ai/docs#6032 deploys. Until
then the fetched file reads "Open source (Python)". No action needed; it
self-corrects.
---
Written with Claude Code; I reviewed the diff and ran the verification
above.
2026-09-14 15:45:19 -04:00
John Kennedy and langsmith-fleet[bot]
e539ac122f
chore(deps): fix vulnerable dev dependencies ( #8449 )
...
## Summary
Patch both `js-yaml` release lines in `libs/cli/js-examples` for
GHSA-2883-xcg3-v3hh: Jest's transitive copy to 3.15.2 and ESLint's to
4.3.2. Updates the existing fix rather than opening a duplicate; no
runtime dependencies added and no major-version overrides.
Addresses Dependabot alerts
[#398 ](https://github.com/langchain-ai/langgraph/security/dependabot/398 )
and
[#397 ](https://github.com/langchain-ai/langgraph/security/dependabot/397 ).
These are real vulnerable versions in example development tooling; patch
rather than dismiss. Alerts remain open until this reaches `main` and
GitHub rescans.
## Verification
- [x] Yarn 1.22.22 regenerated the lockfile with lifecycle scripts
disabled; diff limited to the two js-yaml entries and scoped
resolutions.
- [x] `yarn install --frozen-lockfile --ignore-scripts --force
--non-interactive` in `libs/cli/js-examples`.
- [x] `yarn why js-yaml`: ESLint 4.3.2 and Jest/Istanbul 3.15.2.
- [x] Resolved versions checked against freshly retrieved GitHub
advisory patched versions for both alerts.
- [x] `yarn format:check` and `git diff --check`.
- [ ] Build fails in unchanged `tests/graph.int.test.ts:7`: `input` is
not a valid update property (also recorded in the earlier PR
verification).
- [ ] Unit-test script fails because it uses Jest's removed
`--testPathPattern` option; Jest requires `--testPathPatterns`.
- [ ] Lint fails because ESLint 10 requires `eslint.config.*`, which
this example lacks.
The build/test/lint configuration issues are outside this scoped
dependency patch and remain unresolved. No full test-pass claim.
---------
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
2026-09-09 00:22:43 -07:00
dependabot[bot] and John Kennedy
ff4529380d
chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/cli ( #8863 )
...
Bumps [httpx2](https://github.com/pydantic/httpx2 ) from 2.10.0 to
2.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/releases ">httpx2's
releases</a>.</em></p>
<blockquote>
<h2>v2.12.0</h2>
<h2>Highlights</h2>
<h3>🛡️ Bounded response decompression</h3>
<p><code>httpx2</code> now decodes <code>gzip</code>,
<code>deflate</code>, Brotli, and Zstandard responses incrementally.
Each decode step emits at most 1 MiB, so streaming a highly compressed
response no longer requires materializing an entire inflated network
chunk in memory (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126 ">pydantic/httpx2#1126</a>).</p>
<h3>📦 Shared Zstandard API</h3>
<p>Python 3.13 and earlier now use <code>backports.zstd</code>, which
provides the same bounded incremental decompression API as
<code>compression.zstd</code> on Python 3.14 and later (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146 ">pydantic/httpx2#1146</a>).</p>
<h2>httpx2</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1146 ">pydantic/httpx2#1146</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1126 ">pydantic/httpx2#1126</a></li>
</ul>
<h2>httpcore2</h2>
<p>No changes since <code>2.11.0</code>. Version bumped to stay in
lockstep with <code>httpx2</code>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0 ">https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0 </a></p>
<h2>v2.11.0</h2>
<h2>Highlights</h2>
<h3>🌐 Public origin API</h3>
<p><code>httpx2</code> now includes an immutable and hashable
<code>Origin</code> value object, available through
<code>URL.origin</code>. It provides normalized scheme, host, and
effective port comparisons without including URL paths, queries,
fragments, or credentials (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134 ">pydantic/httpx2#1134</a>).</p>
<h3>🛠️ Request compatibility and validation</h3>
<ul>
<li>Explicit <code>Transfer-Encoding</code> headers now take precedence
over body-derived <code>Content-Length</code> headers (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137 ">pydantic/httpx2#1137</a>).</li>
<li>Deprecated status code aliases are available again (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135 ">pydantic/httpx2#1135</a>).</li>
<li>Multipart part headers are validated before serialization (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142 ">pydantic/httpx2#1142</a>).</li>
</ul>
<h2>httpx2</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1134 ">pydantic/httpx2#1134</a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra by
<a href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1141 ">pydantic/httpx2#1141</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md ">httpx2's
changelog</a>.</em></p>
<blockquote>
<h2>2.12.0 (August 18th, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146 ">#1146</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126 ">#1126</a>)</li>
</ul>
<h2>2.11.0 (August 18th, 2026)</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property for normalized,
hashable origin comparisons. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134 ">#1134</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1141 ">#1141</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Restore deprecated status code aliases. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135 ">#1135</a>)</li>
<li>Extract HTTP/2 release notes from changelog headings correctly. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1136 ">#1136</a>)</li>
<li>Respect explicit <code>Transfer-Encoding</code> headers and expose
buffered request body lengths to WSGI applications.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137 ">#1137</a>)</li>
<li>Validate multipart part header names and values before
serialization.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142 ">#1142</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/httpx2/commit/71ae23be5448f859c2b4e21d9972ddfa7b8d759d "><code>71ae23b</code></a>
Version 2.12.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1147 ">#1147</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8 "><code>4fd0c70</code></a>
Decode compressed response bodies incrementally (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1126 ">#1126</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d588e528a11eb20323031ee571fadc668bb81b3f "><code>d588e52</code></a>
Use <code>backports.zstd</code> on Python 3.13 and earlier (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1146 ">#1146</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/344589da2a992f7e5a0c25c68cc78c25ec6d70bd "><code>344589d</code></a>
Version 2.11.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1143 ">#1143</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/de96d810ee4e309d118982fe7084a46a2bcd600d "><code>de96d81</code></a>
Validate multipart part headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1142 ">#1142</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/51c32698ce029140cb69a26921d017e3edda80fa "><code>51c3269</code></a>
Require brotli 1.2.0 in the brotli extra (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1141 ">#1141</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab "><code>829b93a</code></a>
Respect explicit Transfer-Encoding headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1137 ">#1137</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fa6c8ee96fb79035c6820e4f44a10b6262d9c9f "><code>4fa6c8e</code></a>
Fix changelog extraction regex for H2 release headings (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1136 ">#1136</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/8a6f37063514ee2a2601607c20be72667fdfa3be "><code>8a6f370</code></a>
Restore deprecated status code aliases (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1135 ">#1135</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d03f1ec6a1a323f951a8c21cd14f9c02f2d1e855 "><code>d03f1ec</code></a>
Add public Origin API (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1134 ">#1134</a>)</li>
<li>See full diff in <a
href="https://github.com/pydantic/httpx2/compare/v2.10.0...v2.12.0 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
2026-09-09 06:32:13 +00:00
c0b884e6d8
chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /libs/cli/js-monorepo-example ( #8867 )
...
Bumps [js-yaml](https://github.com/nodeca/js-yaml ) from 4.3.1 to 4.3.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md ">js-yaml's
changelog</a>.</em></p>
<blockquote>
<h2>4.3.2 - 2026-08-26</h2>
<h3>Changed</h3>
<ul>
<li>[backport] Hard-limit merge sequence size to 100.</li>
</ul>
<h3>Security</h3>
<ul>
<li>[backport] Count empty mappings in merge sequences toward
<code>maxTotalMergeKeys</code>
to limit CPU usage, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/797 ">#797</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodeca/js-yaml/commit/79ca68d90f333fbe6d9e42827527e62636200191 "><code>79ca68d</code></a>
4.3.2 released</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b "><code>d90b661</code></a>
Backport merge limits from v5.4.1</li>
<li>See full diff in <a
href="https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-09 06:19:17 +00:00
dependabot[bot]
3299a1f563
chore(deps): bump httpcore2 from 2.5.0 to 2.10.0 in /libs/cli ( #8864 )
...
Bumps [httpcore2](https://github.com/pydantic/httpx2 ) from 2.5.0 to
2.10.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/releases ">httpcore2's
releases</a>.</em></p>
<blockquote>
<h2>v2.10.0</h2>
<h2>Highlights</h2>
<h3>🚀 Performance and memory improvements</h3>
<ul>
<li>Sending large HTTP/2 request bodies no longer copies the body
quadratically - sending a 256 MiB body went from ~36s to under 0.1s (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1127 ">pydantic/httpx2#1127</a>).</li>
<li>SSE parsing is up to 35x faster on highly fragmented streams (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1117 ">pydantic/httpx2#1117</a>).</li>
<li>Cookie extraction is now skipped for responses without a
<code>Set-Cookie</code> header, making typical requests roughly 8%
faster (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1107 ">pydantic/httpx2#1107</a>).</li>
</ul>
<h3>🕸️ WebAssembly / Emscripten support</h3>
<p><code>httpx2</code> now runs on Pyodide / Emscripten, using a
JavaScript <code>fetch</code>-based transport defined in
<code>httpx2-jsfetch</code> (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1119 ">pydantic/httpx2#1119</a>,
<a
href="https://redirect.github.com/pydantic/httpx2/pull/1114 ">pydantic/httpx2#1114</a>).
Thanks <a
href="https://github.com/hoodmane "><code>@hoodmane</code></a>!</p>
<h2>httpx2</h2>
<h3>Added</h3>
<ul>
<li>Add support for running on WebAssembly / Emscripten via Pyodide by
<a href="https://github.com/hoodmane "><code>@hoodmane</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1119 ">pydantic/httpx2#1119</a></li>
<li>Add <code>max_event_size</code> to cap SSE event buffering by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1071 ">pydantic/httpx2#1071</a></li>
<li>Add RFC 9110 status code constants by <a
href="https://github.com/mbeijen "><code>@mbeijen</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1069 ">pydantic/httpx2#1069</a></li>
<li>Add support for Python 3.15 by <a
href="https://github.com/hugovk "><code>@hugovk</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1090 ">pydantic/httpx2#1090</a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Improve SSE chunk buffering performance by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1117 ">pydantic/httpx2#1117</a></li>
<li>Skip cookie extraction without <code>Set-Cookie</code> by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1107 ">pydantic/httpx2#1107</a></li>
<li>Return <code>str | None</code> instead of <code>Any</code> from
<code>Headers.get</code> by <a
href="https://github.com/ItsDrike "><code>@ItsDrike</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1121 ">pydantic/httpx2#1121</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Enforce WebSocket max message size across fragments by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1085 ">pydantic/httpx2#1085</a></li>
<li>Ignore unsolicited and duplicate Pong frames by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1122 ">pydantic/httpx2#1122</a></li>
</ul>
<h2>httpcore2</h2>
<h3>Added</h3>
<ul>
<li>Add support for Python 3.15 by <a
href="https://github.com/hugovk "><code>@hugovk</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1090 ">pydantic/httpx2#1090</a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Avoid quadratic copying when sending large HTTP/2 request bodies by
<a href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1127 ">pydantic/httpx2#1127</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Propagate the original exception instead of raising
<code>KeyError</code> when an HTTP/2 stream fails by <a
href="https://github.com/yhay81 "><code>@yhay81</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1093 ">pydantic/httpx2#1093</a></li>
<li>Start TLS for the <code>wss</code> scheme in SOCKS5 proxy
connections by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1104 ">pydantic/httpx2#1104</a></li>
</ul>
<h2>🙏 New Contributors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/httpx2/commit/a966320e75477b8c55ee78fdb8f57ead6a574cb0 "><code>a966320</code></a>
Version 2.10.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1129 ">#1129</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/586f968f5510aa4d3b7edd1f1b039684c42945ee "><code>586f968</code></a>
Avoid quadratic copying when sending large HTTP/2 request bodies (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1127 ">#1127</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/dee1d1ace3021404d0aa255957821eda97c94c43 "><code>dee1d1a</code></a>
Return <code>str | None</code> instead of <code>Any</code> from
<code>Headers.get</code> (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1121 ">#1121</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/dec24ad57d1d337de7de23c011eb566a145e7b40 "><code>dec24ad</code></a>
Use <code>httpx2-jsfetch</code> on Emscripten (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1119 ">#1119</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/454b8b2197f62d699ff3ad762917643926b4da77 "><code>454b8b2</code></a>
Ignore unsolicited and duplicate Pong frames (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1122 ">#1122</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/cbfc0e04ef6507da29ccbb3b9c2e5b23dd693414 "><code>cbfc0e0</code></a>
Improve SSE chunk buffering performance (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1117 ">#1117</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/ad141d876c7d3c3f58555cbb0a178ec2c1f15b51 "><code>ad141d8</code></a>
Refactor SSE parser coordination (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1118 ">#1118</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/e0b01245e42d2091034ee9455cbb068bc0d6c0c6 "><code>e0b0124</code></a>
Make <code>_client</code> depend on the <code>_transports</code> package
instead of its submodules ...</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/e52f963c62f397f225c8d29573aedbe5ae613906 "><code>e52f963</code></a>
Skip dependencies not needed on Emscripten (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1114 ">#1114</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/5d9eedc98186c612d0e426df417f78f6ec21e9ca "><code>5d9eedc</code></a>
Add <code>max_event_size</code> to cap SSE event buffering (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1071 ">#1071</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pydantic/httpx2/compare/v2.5.0...v2.10.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-08 21:26:36 -07:00
Parker J. Rule
0199b519e1
fix(cli): clarify missing deploy config ( #8854 )
...
Shows an actionable, docs-linked error when `langgraph deploy` is run
without a `langgraph.json` instead of exposing a traceback.
2026-09-08 17:03:14 +00:00
Nick Hollon
81bf17b231
fix(langgraph): type undeclared v3 stream projections ( #8596 )
2026-09-03 11:23:25 -04:00
John Kennedy and langsmith-fleet[bot]
11738d83db
chore(langgraph): bump mistune to 3.3.4 ( #8804 )
...
Updates the `libs/langgraph/uv.lock` development dependency from Mistune
3.3.0 to 3.3.4, resolving GHSA-6m44-fpc8-c3rq (Dependabot #389 ). The
change is scoped to the affected lockfile.
Validation: `uv lock --project libs/langgraph --locked`.
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
2026-09-02 17:38:30 -07:00
dependabot[bot]
1983e60971
chore(deps): bump browserslist from 4.28.1 to 4.28.8 in /libs/cli/js-examples ( #8797 )
...
Bumps [browserslist](https://github.com/browserslist/browserslist ) from
4.28.1 to 4.28.8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/browserslist/browserslist/releases ">browserslist's
releases</a>.</em></p>
<blockquote>
<h2>4.28.8</h2>
<ul>
<li>Fixed <code>including kaios</code> in baseline queries (by <a
href="https://github.com/Jaybhade "><code>@Jaybhade</code></a>).</li>
</ul>
<h2>4.28.7</h2>
<ul>
<li>Improved parsing performance.</li>
<li>Fixed unbounded memory growth (by <a
href="https://github.com/alanturing881 "><code>@alanturing881</code></a>).</li>
<li>Fixed prototype write issue (by <a
href="https://github.com/alanturing881 "><code>@alanturing881</code></a>).</li>
</ul>
<h2>4.28.6</h2>
<ul>
<li>Fixed Electron version queries (by <a
href="https://github.com/spokodev "><code>@spokodev</code></a>).</li>
</ul>
<h2>4.28.5</h2>
<ul>
<li>Fixed <code>></code> and <code>>=</code> queries (by <a
href="https://github.com/spokodev "><code>@spokodev</code></a>).</li>
</ul>
<h2>4.28.4</h2>
<ul>
<li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li>
</ul>
<h2>4.28.3</h2>
<ul>
<li>Fixed baseline query case-insensitivity (by <a
href="https://github.com/swwind "><code>@swwind</code></a>).</li>
</ul>
<h2>4.28.2</h2>
<ul>
<li>Fix prototype pollution (by <a
href="https://github.com/chluo1997 "><code>@chluo1997</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md ">browserslist's
changelog</a>.</em></p>
<blockquote>
<h2>4.28.8</h2>
<ul>
<li>Fixed <code>including kaios</code> in baseline queries (by <a
href="https://github.com/Jaybhade "><code>@Jaybhade</code></a>).</li>
</ul>
<h2>4.28.7</h2>
<ul>
<li>Improved parsing performance.</li>
<li>Fixed unbounded memory growth (by <a
href="https://github.com/alanturing881 "><code>@alanturing881</code></a>).</li>
<li>Fixed prototype write issue (by <a
href="https://github.com/alanturing881 "><code>@alanturing881</code></a>).</li>
</ul>
<h2>4.28.6</h2>
<ul>
<li>Fixed Electron version queries (by <a
href="https://github.com/spokodev "><code>@spokodev</code></a>).</li>
</ul>
<h2>4.28.5</h2>
<ul>
<li>Fixed <code>></code> and <code>>=</code> queries (by <a
href="https://github.com/spokodev "><code>@spokodev</code></a>).</li>
</ul>
<h2>4.28.4</h2>
<ul>
<li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li>
</ul>
<h2>4.28.3</h2>
<ul>
<li>Fixed baseline query case-insensitivity (by <a
href="https://github.com/swwind "><code>@swwind</code></a>).</li>
</ul>
<h2>4.28.2</h2>
<ul>
<li>Fix prototype pollution (by <a
href="https://github.com/chluo1997 "><code>@chluo1997</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/browserslist/browserslist/commit/f2f2e6cfb01bb4942941d328737546f4e2ae41ad "><code>f2f2e6c</code></a>
Release 4.28.8 version</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/d0787c88fa29ba895fea51cfe921232c7b5d1377 "><code>d0787c8</code></a>
Update dependencies</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/fcf8fa9857b30ccdf801a548f5d09d3c4ff0d43f "><code>fcf8fa9</code></a>
Merge pull request <a
href="https://redirect.github.com/browserslist/browserslist/issues/939 ">#939</a>
from Jaybhade/fix/baseline-kaios-without-downstream</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/57ecd64454e9252afdd6a7e76926e13dda48a38c "><code>57ecd64</code></a>
fix: support "including kaios" without downstream</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/093a0f67bb0becda55235d767b134df3197c54a1 "><code>093a0f6</code></a>
Update EM banner</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/b637868045806d2fba4c24eb0060e4cc8b1db276 "><code>b637868</code></a>
Release 4.28.7 version</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/313f4659b9f985ade89d1d6a54a860371c41cc46 "><code>313f465</code></a>
Update dependencies</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/c935c5a206f8b13db8846818bc03643e147dcbdf "><code>c935c5a</code></a>
Fix regexp performance</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/d7e9e653cb53399065943f59f0b3063987b0a008 "><code>d7e9e65</code></a>
Rewrite structure parsing to make it always fast</li>
<li><a
href="https://github.com/browserslist/browserslist/commit/ec4a55efd76bdfa506ec7ce4fea1691559e9ca8f "><code>ec4a55e</code></a>
Fix import order</li>
<li>Additional commits viewable in <a
href="https://github.com/browserslist/browserslist/compare/4.28.1...4.28.8 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for browserslist since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 13:27:41 -07:00
dependabot[bot]
d07198a53c
chore(deps): bump @humanfs/node from 0.16.7 to 0.16.8 in /libs/cli/js-examples ( #8798 )
...
Bumps
[@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node )
from 0.16.7 to 0.16.8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/humanwhocodes/humanfs/releases ">@humanfs/node's
releases</a>.</em></p>
<blockquote>
<h2>node: v0.16.8</h2>
<h2><a
href="https://github.com/humanwhocodes/humanfs/compare/node-v0.16.7...node-v0.16.8 ">0.16.8</a>
(2026-04-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Include type dependencies at runtime (<a
href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138 ">956ce7a</a>),
closes <a
href="https://redirect.github.com/humanwhocodes/humanfs/issues/145 ">#145</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li><code>@humanfs/core</code> bumped from ^0.19.1 to ^0.19.2</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md ">@humanfs/node's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/humanwhocodes/humanfs/compare/node-v0.16.7...node-v0.16.8 ">0.16.8</a>
(2026-04-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Ensure symlinks are copied as symlinks in <code>copy()</code> and
<code>copyAll()</code> (<a
href="https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404 ">22bbaa44</a>)</li>
<li>Include type dependencies at runtime (<a
href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138 ">956ce7a</a>),
closes <a
href="https://redirect.github.com/humanwhocodes/humanfs/issues/145 ">#145</a></li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li><code>@humanfs/core</code> bumped from ^0.19.1 to ^0.19.2</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/humanwhocodes/humanfs/commit/e96070e897f017ae8abd2b0676d98d14e49665cc "><code>e96070e</code></a>
chore: release main (<a
href="https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node/issues/146 ">#146</a>)</li>
<li><a
href="https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404 "><code>22bbaa4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138 "><code>956ce7a</code></a>
fix: Include type dependencies at runtime</li>
<li>See full diff in <a
href="https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 13:27:21 -07:00
c0a13bb22d
chore(deps): bump the minor-and-patch group across 1 directory with 7 updates ( #8779 )
...
Bumps the minor-and-patch group with 7 updates in the /libs/sdk-py
directory:
| Package | From | To |
| --- | --- | --- |
| [orjson](https://github.com/ijl/orjson ) | `3.11.9` | `3.12.0` |
| [langchain-protocol](https://github.com/langchain-ai/agent-protocol ) |
`0.0.18` | `0.0.19` |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.5.3`
| `1.6.1` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.1` | `0.16.5` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.66` | `0.0.75` |
| [starlette](https://github.com/Kludex/starlette ) | `1.3.1` | `1.6.0` |
| [pydantic](https://github.com/pydantic/pydantic ) | `2.13.4` | `2.13.5`
|
Updates `orjson` from 3.11.9 to 3.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ijl/orjson/releases ">orjson's
releases</a>.</em></p>
<blockquote>
<h2>3.12.0</h2>
<h3>Changed</h3>
<ul>
<li>Serialization implementation substantially rewritten.</li>
<li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
<code>manylinux_2_39</code> (2024) is targeted instead of
<code>manylinux_2_17</code> (2012).</li>
<li>No longer publish PyPI wheels for ppc64le and s390x.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md ">orjson's
changelog</a>.</em></p>
<blockquote>
<h2>3.12.0 - 2026-08-14</h2>
<h3>Changed</h3>
<ul>
<li>Serialization implementation substantially rewritten.</li>
<li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
<code>manylinux_2_39</code> (2024) is targeted instead of
<code>manylinux_2_17</code> (2012).</li>
<li>No longer publish PyPI wheels for ppc64le and s390x.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ijl/orjson/commit/6737895a1a4e3e26df0569a40147893a786f9a58 "><code>6737895</code></a>
3.12.0</li>
<li><a
href="https://github.com/ijl/orjson/commit/c2a6e8ff7b898635fb68a85bd5a62df1edf61cfc "><code>c2a6e8f</code></a>
JsonWriter, iterators</li>
<li><a
href="https://github.com/ijl/orjson/commit/6a2d7a7d66dc3c5698625a7b334c40db459e46ae "><code>6a2d7a7</code></a>
yyjson 1ea2fb0</li>
<li><a
href="https://github.com/ijl/orjson/commit/97bf170d9726e91c891f35eae4892801520b9dce "><code>97bf170</code></a>
build update</li>
<li>See full diff in <a
href="https://github.com/ijl/orjson/compare/3.11.9...3.12.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain-protocol` from 0.0.18 to 0.0.19
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/agent-protocol/releases ">langchain-protocol's
releases</a>.</em></p>
<blockquote>
<h2>langchain-protocol==0.0.19</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(tooling): resolve datamodel-code-generator alerts by <a
href="https://github.com/jkennedyvz "><code>@jkennedyvz</code></a> in <a
href="https://redirect.github.com/langchain-ai/agent-protocol/pull/93 ">langchain-ai/agent-protocol#93</a></li>
<li>feat: add LangSmith routing to run start by <a
href="https://github.com/mdrxy "><code>@mdrxy</code></a> in <a
href="https://redirect.github.com/langchain-ai/agent-protocol/pull/95 ">langchain-ai/agent-protocol#95</a></li>
<li>release: v0.19.0 by <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>
in <a
href="https://redirect.github.com/langchain-ai/agent-protocol/pull/96 ">langchain-ai/agent-protocol#96</a></li>
<li>fix(py): pin hatchling to avoid metadata 2.5 publish failure by <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>
in <a
href="https://redirect.github.com/langchain-ai/agent-protocol/pull/97 ">langchain-ai/agent-protocol#97</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19 ">https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/59c02be488eb7adb98ae3450983fff293294e67a "><code>59c02be</code></a>
fix(py): pin hatchling to avoid metadata 2.5 publish failure (<a
href="https://redirect.github.com/langchain-ai/agent-protocol/issues/97 ">#97</a>)</li>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/c59077b743fd3dd0b86f048a2b59128de413663d "><code>c59077b</code></a>
release: v0.19.0 (<a
href="https://redirect.github.com/langchain-ai/agent-protocol/issues/96 ">#96</a>)</li>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/870ef9560fab320236d6e24770e8950c5a9be63d "><code>870ef95</code></a>
Merge pull request <a
href="https://redirect.github.com/langchain-ai/agent-protocol/issues/95 ">#95</a>
from langchain-ai/open-swe/v3-replica-routing</li>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/175a1b8f2ac974e9b5097de90a51f1bc7ade73e0 "><code>175a1b8</code></a>
feat(protocol): add LangSmith routing to run start</li>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/d9fd23d762bf4cffe876890a854fb79bcdd14f1a "><code>d9fd23d</code></a>
Merge pull request <a
href="https://redirect.github.com/langchain-ai/agent-protocol/issues/93 ">#93</a>
from langchain-ai/langster/fix-datamodel-code-generato...</li>
<li><a
href="https://github.com/langchain-ai/agent-protocol/commit/9476948ab0ce1027131b58b9813f6bd3ba238ef8 "><code>9476948</code></a>
fix(tooling): update code generator dependencies</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain-core` from 1.5.3 to 1.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.1</h2>
<p>Changes since langchain-core==1.6.0</p>
<p>revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)
chore(deps): bump minor and patch dependencies (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39869 ">#39869</a>)
release(core): 1.6.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39832 ">#39832</a>)
feat(core): propagate gateway information on error path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39829 ">#39829</a>)</p>
<h2>langchain-core==1.6.0</h2>
<p>Changes since langchain-core==1.5.6</p>
<p>release(core): 1.6.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39760 ">#39760</a>)
fix(core): resolve postponed annotations in
<code>StructuredTool._injected_args_keys</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39602 ">#39602</a>)
feat(core): add standard model exception types (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39538 ">#39538</a>)
fix(core): allow deserializing <code>RunnablePick</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39753 ">#39753</a>)
fix(core): make <code>convert_to_openai_function</code> handle callables
and non-dict mappings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39750 ">#39750</a>)
fix(core): make subprocess and temporary file tests portable on Windows
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39664 ">#39664</a>)
fix(core): fail fast when tool schemas can't resolve forward refs during
serialization (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39570 ">#39570</a>)
test(core): avoid version-dependent runnable snapshots (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39705 ">#39705</a>)
fix(core): require all nested properties for strict tool schemas (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39306 ">#39306</a>)
fix(core): remove stale sync-stream <code>xfail</code> [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39720 ">#39720</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39723 ">#39723</a>)
perf(core): Lazily import transformers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38037 ">#38037</a>)
fix(core): accept non-dict Mapping values in mustache templates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39680 ">#39680</a>)
docs(core): clarify <code>Runnable</code> pipe coercion [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39075 ">#39075</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39707 ">#39707</a>)
fix(core): finalize chain-group runs on <code>BaseException</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39699 ">#39699</a>)</p>
<h2>langchain-core==1.5.6</h2>
<p>Changes since langchain-core==1.5.5</p>
<p>chore(core): release 1.5.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39704 ">#39704</a>)
feat(core): incorporate gateway metadata to traces (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39703 ">#39703</a>)</p>
<h2>langchain-core==1.5.5</h2>
<p>Changes since langchain-core==1.5.4</p>
<p>release(core): 1.5.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39655 ">#39655</a>)
fix(core): make abatch_iterate consistent with batch_iterate for None
and zero size (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39367 ">#39367</a>)
fix(core): respect pydantic aliases when validating tool inputs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39572 ">#39572</a>)
fix(core): issues in merging chunks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39535 ">#39535</a>)
fix(core): handle v1 base model validation in async path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39576 ">#39576</a>)
fix(core): handle tool descriptions for infer_schema=False (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39573 ">#39573</a>)
fix(core): clear usage metadata callback on exceptions in context
manager (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39616 ">#39616</a>)
fix(core): handle falsy LLM and chat model caches (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39283 ">#39283</a>)
chore(core): add httpx as an explicit dep (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39612 ">#39612</a>)
fix(core): preserve non-str/non-dict items in
<code>DictPromptTemplate</code> list values (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39588 ">#39588</a>)
fix(core): raise ValueError when explicit tool_outputs length mismatches
tool_calls in tool_example_to_messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39142 ">#39142</a>)
fix(core): guard malformed Anthropic content blocks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38670 ">#38670</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46 "><code>4fe9d30</code></a>
chore(openai): fix tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39972 ">#39972</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c "><code>8fa38dc</code></a>
revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372 "><code>122030d</code></a>
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b "><code>7d4b42b</code></a>
release(langchain): 1.3.18 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39966 ">#39966</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83 "><code>4a66e35</code></a>
fix(langchain): preserve content-block shape in PIIMiddleware redaction
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39894 ">#39894</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3 "><code>38e2113</code></a>
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e "><code>13b1b2f</code></a>
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26 "><code>3b3b308</code></a>
release(anthropic): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39963 ">#39963</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4 "><code>e3f6adf</code></a>
feat(anthropic): support top-level param for skills via
<code>container</code>; `updates...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa "><code>c253f54</code></a>
fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and
gpt-5.1 profiles...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.1 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.1...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.66 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.66...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `starlette` from 1.3.1 to 1.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases ">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 1.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add <code>max_body_size</code> to <code>Starlette</code> and route
classes by <a href="https://github.com/Kludex "><code>@Kludex</code></a>
in <a
href="https://redirect.github.com/Kludex/starlette/pull/3431 ">Kludex/starlette#3431</a></li>
<li>Expose <code>http.response.debug</code> info via response extensions
by <a href="https://github.com/y2kbugger "><code>@y2kbugger</code></a>
in <a
href="https://redirect.github.com/Kludex/starlette/pull/3130 ">Kludex/starlette#3130</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/y2kbugger "><code>@y2kbugger</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3130 ">Kludex/starlette#3130</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.5.1...1.6.0 ">https://github.com/Kludex/starlette/compare/1.5.1...1.6.0 </a></p>
<h2>Version 1.5.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Reject inverted single-byte Range like <code>bytes=5-4</code> by <a
href="https://github.com/nikolauspschuetz "><code>@nikolauspschuetz</code></a>
in <a
href="https://redirect.github.com/encode/starlette/pull/3389 ">encode/starlette#3389</a></li>
<li>Limit <code>FileResponse</code> to 100 ranges by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/encode/starlette/pull/3430 ">encode/starlette#3430</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/encode/starlette/compare/1.5.0...1.5.1 ">https://github.com/encode/starlette/compare/1.5.0...1.5.1 </a></p>
<h2>Version 1.5.0</h2>
<p>This release is all about giving <code>GZipMiddleware</code> some
love. 🗜️ </p>
<h2>What's Changed</h2>
<ul>
<li>Add <code>exclude_content_types</code> parameter to
<code>GZipMiddleware</code> by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/encode/starlette/pull/3418 ">encode/starlette#3418</a></li>
<li>Flush GZip output for each streamed chunk by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/encode/starlette/pull/3419 ">encode/starlette#3419</a></li>
<li>Skip compression of partial responses in <code>GZipMiddleware</code>
by <a href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/encode/starlette/pull/3420 ">encode/starlette#3420</a></li>
<li>Expand default excluded content types in <code>GZipMiddleware</code>
by <a href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/encode/starlette/pull/3421 ">encode/starlette#3421</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/encode/starlette/compare/1.4.1...1.5.0 ">https://github.com/encode/starlette/compare/1.4.1...1.5.0 </a></p>
<h2>Version 1.4.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Default <code>thread_minimum_size</code> in
<code>GZipResponder</code> by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3415 ">Kludex/starlette#3415</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.4.0...1.4.1 ">https://github.com/Kludex/starlette/compare/1.4.0...1.4.1 </a></p>
<h2>Version 1.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Lazily allocate GZipMiddleware compression resources by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3407 ">Kludex/starlette#3407</a></li>
<li>Use <code>zlib.compressobj</code> instead of <code>GzipFile</code>
in <code>GZipMiddleware</code> by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3411 ">Kludex/starlette#3411</a></li>
<li>Offload large GZip compression by <a
href="https://github.com/Kludex "><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/starlette/pull/3410 ">Kludex/starlette#3410</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/benberryallwood "><code>@benberryallwood</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3334 ">Kludex/starlette#3334</a></li>
<li><a href="https://github.com/lkk7 "><code>@lkk7</code></a> made their
first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3359 ">Kludex/starlette#3359</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/1.3.1...1.4.0 ">https://github.com/Kludex/starlette/compare/1.3.1...1.4.0 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md ">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>1.6.0 (August 8, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>max_body_size</code> to <code>Starlette</code> and route
classes <a
href="https://redirect.github.com/encode/starlette/pull/3431 ">#3431</a>.</li>
<li>Expose <code>http.response.debug</code> information via response
extensions <a
href="https://redirect.github.com/encode/starlette/pull/3130 ">#3130</a>.</li>
</ul>
<h2>1.5.1 (August 8, 2026)</h2>
<h4>Fixed</h4>
<ul>
<li>Reject inverted single-byte ranges in <code>FileResponse</code> <a
href="https://redirect.github.com/encode/starlette/pull/3389 ">#3389</a>.</li>
<li>Limit <code>FileResponse</code> to 100 ranges <a
href="https://redirect.github.com/encode/starlette/pull/3430 ">#3430</a>.</li>
</ul>
<h2>1.5.0 (August 8, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>exclude_content_types</code> parameter to
<code>GZipMiddleware</code> <a
href="https://redirect.github.com/encode/starlette/pull/3418 ">#3418</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Expand default excluded content types in <code>GZipMiddleware</code>
<a
href="https://redirect.github.com/encode/starlette/pull/3421 ">#3421</a>.</li>
</ul>
<h4>Fixed</h4>
<ul>
<li>Flush GZip output for each streamed chunk <a
href="https://redirect.github.com/encode/starlette/pull/3419 ">#3419</a>.</li>
<li>Skip compression of partial responses in <code>GZipMiddleware</code>
<a
href="https://redirect.github.com/encode/starlette/pull/3420 ">#3420</a>.</li>
</ul>
<h2>1.4.1 (August 5, 2026)</h2>
<h4>Fixed</h4>
<ul>
<li>Default <code>thread_minimum_size</code> to 128 KiB in
<code>GZipResponder</code>, keeping it usable without the new keyword
argument <a
href="https://redirect.github.com/encode/starlette/pull/3415 ">#3415</a>.</li>
</ul>
<h2>1.4.0 (August 5, 2026)</h2>
<h4>Added</h4>
<ul>
<li>Offload large GZip compression to a worker thread, keeping the event
loop responsive. <code>GZipMiddleware</code> accepts a new
<code>thread_minimum_size</code> parameter (default 128 KiB) controlling
the minimum body chunk size compressed in a thread <a
href="https://redirect.github.com/encode/starlette/pull/3410 ">#3410</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Use <code>zlib.compressobj</code> instead of <code>GzipFile</code>
in <code>GZipMiddleware</code>, reducing memory usage during compression
<a
href="https://redirect.github.com/encode/starlette/pull/3411 ">#3411</a>.</li>
<li>Lazily allocate <code>GZipMiddleware</code> compression resources,
avoiding compressor allocation for responses that are never compressed
<a
href="https://redirect.github.com/encode/starlette/pull/3407 ">#3407</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/4f250d6b814587e20c5365f0a5f0c4d42bcb929f "><code>4f250d6</code></a>
Version 1.6.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3434 ">#3434</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/9eea41ad3c26ad21b9bdfe4578c1cdad6c9b9ac2 "><code>9eea41a</code></a>
Expose <code>http.response.debug</code> info via response extensions (<a
href="https://redirect.github.com/Kludex/starlette/issues/3130 ">#3130</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/38f8999a229610b36f39d11f67d80515a15c6330 "><code>38f8999</code></a>
Add <code>max_body_size</code> to <code>Starlette</code> and route
classes (<a
href="https://redirect.github.com/Kludex/starlette/issues/3431 ">#3431</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/c41236c03868fb3779a64101f4ea88cd47877e23 "><code>c41236c</code></a>
Version 1.5.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3432 ">#3432</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/9c500db197859dba4a8db13fa8e7d2c55de8152c "><code>9c500db</code></a>
Limit <code>FileResponse</code> to 100 ranges (<a
href="https://redirect.github.com/Kludex/starlette/issues/3430 ">#3430</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/78ae82cad482fe66a73fb1217f0a6609b3f998f6 "><code>78ae82c</code></a>
Reject inverted single-byte Range like bytes=5-4 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3389 ">#3389</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/c1d6edaf43920104d4389e983c3e0314f6af14cf "><code>c1d6eda</code></a>
chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3429 ">#3429</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/ee66ca48418780d6415d231851b31464febc32de "><code>ee66ca4</code></a>
chore(deps): bump the python-packages group across 1 directory with 8
updates...</li>
<li><a
href="https://github.com/Kludex/starlette/commit/00d10167523f819d39d5ca36732348d58645a447 "><code>00d1016</code></a>
fix(tests): skip test_staticfiles_filename_too_long on Windows where
os.pathc...</li>
<li><a
href="https://github.com/Kludex/starlette/commit/d96887ea7b49db3d1d15994be6438c7fe99936f4 "><code>d96887e</code></a>
Add Pydantic Logfire banner to the docs (<a
href="https://redirect.github.com/Kludex/starlette/issues/3428 ">#3428</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/starlette/compare/1.3.1...1.6.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pydantic` from 2.13.4 to 2.13.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/releases ">pydantic's
releases</a>.</em></p>
<blockquote>
<h2>v2.13.5 (2026-08-28)</h2>
<h3>What's Changed</h3>
<h4>Fixes</h4>
<ul>
<li>Allow reuse of validators when plugins are set by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13535 ">#13535</a></li>
<li>Fix missing GC traversal on some <code>pydantic-core</code> struct
fields by <a href="https://github.com/Viicos "><code>@Viicos</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13624 ">#13624</a></li>
<li>Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code> by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13629 ">#13629</a></li>
<li>Count validated model fields once in smart unions by <a
href="https://github.com/tamird "><code>@tamird</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13731 ">#13731</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md ">pydantic's
changelog</a>.</em></p>
<blockquote>
<h2>v2.13.5 (2026-08-28)</h2>
<p><a
href="https://github.com/pydantic/pydantic/releases/tag/v2.13.5 ">GitHub
release</a></p>
<h3>What's Changed</h3>
<h4>Fixes</h4>
<ul>
<li>Allow reuse of validators when plugins are set by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13535 ">#13535</a></li>
<li>Fix missing GC traversal on some <code>pydantic-core</code> struct
fields by <a href="https://github.com/Viicos "><code>@Viicos</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13624 ">#13624</a></li>
<li>Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code> by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13629 ">#13629</a></li>
<li>Count validated model fields once in smart unions by <a
href="https://github.com/tamird "><code>@tamird</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13731 ">#13731</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/pydantic/commit/001dea020e0809844e5b17666432c9135a976f46 "><code>001dea0</code></a>
Bump <code>pypa/gh-action-pypi-publish</code> action to v1.14.2</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/558379fee957fad25858e33596146c72d5674843 "><code>558379f</code></a>
Bump twine to v7.0.0</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/2cfd5d3d2ae721ea882c045f83b7f7a4003aab01 "><code>2cfd5d3</code></a>
Do not check for docs build</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/a735bee5c64e1fe50785c376adaf1275e752b8ac "><code>a735bee</code></a>
Fix more Clippy lints</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/7eed4a16b87afaced4d0eafae230453de3410d64 "><code>7eed4a1</code></a>
Fix Clippy 0.1.95 warnings</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/b353bbb20a4989b4c033e2be2b4a40d36178b16a "><code>b353bbb</code></a>
Prepare release v2.13.5</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/63d2cccd6e760da6bbc7fe81a53cb2bde3768f5e "><code>63d2ccc</code></a>
Count validated model fields once in smart unions</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/a53ec2ed342fda4e6aa3684399d04ea57be9a6e4 "><code>a53ec2e</code></a>
Speed up PyPy CI tests</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/d65e0f96e890ca82f4b66a15d5b3bd65af2c661c "><code>d65e0f9</code></a>
Workaround circular import error in Mypy</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/47a6dbf8ad6216211bd0df6ec5c2c6c6ed905b72 "><code>47a6dbf</code></a>
Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code></li>
<li>Additional commits viewable in <a
href="https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5 ">compare
view</a></li>
</ul>
</details>
<br />
Made by [Open
SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73 )
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-02 09:52:39 +00:00
7bfee11ad5
chore(deps): bump the minor-and-patch group across 1 directory with 4 updates ( #8782 )
...
Bumps the minor-and-patch group with 4 updates in the /libs/langgraph
directory: [langchain-core](https://github.com/langchain-ai/langchain ),
[pydantic](https://github.com/pydantic/pydantic ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `langchain-core` from 1.5.3 to 1.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.1</h2>
<p>Changes since langchain-core==1.6.0</p>
<p>revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)
chore(deps): bump minor and patch dependencies (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39869 ">#39869</a>)
release(core): 1.6.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39832 ">#39832</a>)
feat(core): propagate gateway information on error path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39829 ">#39829</a>)</p>
<h2>langchain-core==1.6.0</h2>
<p>Changes since langchain-core==1.5.6</p>
<p>release(core): 1.6.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39760 ">#39760</a>)
fix(core): resolve postponed annotations in
<code>StructuredTool._injected_args_keys</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39602 ">#39602</a>)
feat(core): add standard model exception types (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39538 ">#39538</a>)
fix(core): allow deserializing <code>RunnablePick</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39753 ">#39753</a>)
fix(core): make <code>convert_to_openai_function</code> handle callables
and non-dict mappings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39750 ">#39750</a>)
fix(core): make subprocess and temporary file tests portable on Windows
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39664 ">#39664</a>)
fix(core): fail fast when tool schemas can't resolve forward refs during
serialization (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39570 ">#39570</a>)
test(core): avoid version-dependent runnable snapshots (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39705 ">#39705</a>)
fix(core): require all nested properties for strict tool schemas (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39306 ">#39306</a>)
fix(core): remove stale sync-stream <code>xfail</code> [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39720 ">#39720</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39723 ">#39723</a>)
perf(core): Lazily import transformers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38037 ">#38037</a>)
fix(core): accept non-dict Mapping values in mustache templates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39680 ">#39680</a>)
docs(core): clarify <code>Runnable</code> pipe coercion [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39075 ">#39075</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39707 ">#39707</a>)
fix(core): finalize chain-group runs on <code>BaseException</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39699 ">#39699</a>)</p>
<h2>langchain-core==1.5.6</h2>
<p>Changes since langchain-core==1.5.5</p>
<p>chore(core): release 1.5.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39704 ">#39704</a>)
feat(core): incorporate gateway metadata to traces (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39703 ">#39703</a>)</p>
<h2>langchain-core==1.5.5</h2>
<p>Changes since langchain-core==1.5.4</p>
<p>release(core): 1.5.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39655 ">#39655</a>)
fix(core): make abatch_iterate consistent with batch_iterate for None
and zero size (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39367 ">#39367</a>)
fix(core): respect pydantic aliases when validating tool inputs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39572 ">#39572</a>)
fix(core): issues in merging chunks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39535 ">#39535</a>)
fix(core): handle v1 base model validation in async path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39576 ">#39576</a>)
fix(core): handle tool descriptions for infer_schema=False (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39573 ">#39573</a>)
fix(core): clear usage metadata callback on exceptions in context
manager (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39616 ">#39616</a>)
fix(core): handle falsy LLM and chat model caches (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39283 ">#39283</a>)
chore(core): add httpx as an explicit dep (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39612 ">#39612</a>)
fix(core): preserve non-str/non-dict items in
<code>DictPromptTemplate</code> list values (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39588 ">#39588</a>)
fix(core): raise ValueError when explicit tool_outputs length mismatches
tool_calls in tool_example_to_messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39142 ">#39142</a>)
fix(core): guard malformed Anthropic content blocks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38670 ">#38670</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46 "><code>4fe9d30</code></a>
chore(openai): fix tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39972 ">#39972</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c "><code>8fa38dc</code></a>
revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372 "><code>122030d</code></a>
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b "><code>7d4b42b</code></a>
release(langchain): 1.3.18 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39966 ">#39966</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83 "><code>4a66e35</code></a>
fix(langchain): preserve content-block shape in PIIMiddleware redaction
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39894 ">#39894</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3 "><code>38e2113</code></a>
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e "><code>13b1b2f</code></a>
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26 "><code>3b3b308</code></a>
release(anthropic): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39963 ">#39963</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4 "><code>e3f6adf</code></a>
feat(anthropic): support top-level param for skills via
<code>container</code>; `updates...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa "><code>c253f54</code></a>
fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and
gpt-5.1 profiles...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pydantic` from 2.13.4 to 2.13.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/releases ">pydantic's
releases</a>.</em></p>
<blockquote>
<h2>v2.13.5 (2026-08-28)</h2>
<h3>What's Changed</h3>
<h4>Fixes</h4>
<ul>
<li>Allow reuse of validators when plugins are set by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13535 ">#13535</a></li>
<li>Fix missing GC traversal on some <code>pydantic-core</code> struct
fields by <a href="https://github.com/Viicos "><code>@Viicos</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13624 ">#13624</a></li>
<li>Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code> by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13629 ">#13629</a></li>
<li>Count validated model fields once in smart unions by <a
href="https://github.com/tamird "><code>@tamird</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13731 ">#13731</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md ">pydantic's
changelog</a>.</em></p>
<blockquote>
<h2>v2.13.5 (2026-08-28)</h2>
<p><a
href="https://github.com/pydantic/pydantic/releases/tag/v2.13.5 ">GitHub
release</a></p>
<h3>What's Changed</h3>
<h4>Fixes</h4>
<ul>
<li>Allow reuse of validators when plugins are set by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13535 ">#13535</a></li>
<li>Fix missing GC traversal on some <code>pydantic-core</code> struct
fields by <a href="https://github.com/Viicos "><code>@Viicos</code></a>
in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13624 ">#13624</a></li>
<li>Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code> by <a
href="https://github.com/Viicos "><code>@Viicos</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13629 ">#13629</a></li>
<li>Count validated model fields once in smart unions by <a
href="https://github.com/tamird "><code>@tamird</code></a> in <a
href="https://redirect.github.com/pydantic/pydantic/pull/13731 ">#13731</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/pydantic/commit/001dea020e0809844e5b17666432c9135a976f46 "><code>001dea0</code></a>
Bump <code>pypa/gh-action-pypi-publish</code> action to v1.14.2</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/558379fee957fad25858e33596146c72d5674843 "><code>558379f</code></a>
Bump twine to v7.0.0</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/2cfd5d3d2ae721ea882c045f83b7f7a4003aab01 "><code>2cfd5d3</code></a>
Do not check for docs build</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/a735bee5c64e1fe50785c376adaf1275e752b8ac "><code>a735bee</code></a>
Fix more Clippy lints</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/7eed4a16b87afaced4d0eafae230453de3410d64 "><code>7eed4a1</code></a>
Fix Clippy 0.1.95 warnings</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/b353bbb20a4989b4c033e2be2b4a40d36178b16a "><code>b353bbb</code></a>
Prepare release v2.13.5</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/63d2cccd6e760da6bbc7fe81a53cb2bde3768f5e "><code>63d2ccc</code></a>
Count validated model fields once in smart unions</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/a53ec2ed342fda4e6aa3684399d04ea57be9a6e4 "><code>a53ec2e</code></a>
Speed up PyPy CI tests</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/d65e0f96e890ca82f4b66a15d5b3bd65af2c661c "><code>d65e0f9</code></a>
Workaround circular import error in Mypy</li>
<li><a
href="https://github.com/pydantic/pydantic/commit/47a6dbf8ad6216211bd0df6ec5c2c6c6ed905b72 "><code>47a6dbf</code></a>
Fix missing GC traversal in <code>pydantic-core</code> for
<code>GeneralFieldsSerializer</code></li>
<li>Additional commits viewable in <a
href="https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.1 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.1...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.66 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.66...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Made by [Open
SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73 )
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-02 09:46:26 +00:00
eae02c622d
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 updates ( #8777 )
...
Bumps the minor-and-patch group in /libs/checkpoint with 4 updates:
[langchain-core](https://github.com/langchain-ai/langchain ),
[redis](https://github.com/redis/redis-py ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `langchain-core` from 1.5.2 to 1.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.1</h2>
<p>Changes since langchain-core==1.6.0</p>
<p>revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)
chore(deps): bump minor and patch dependencies (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39869 ">#39869</a>)
release(core): 1.6.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39832 ">#39832</a>)
feat(core): propagate gateway information on error path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39829 ">#39829</a>)</p>
<h2>langchain-core==1.6.0</h2>
<p>Changes since langchain-core==1.5.6</p>
<p>release(core): 1.6.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39760 ">#39760</a>)
fix(core): resolve postponed annotations in
<code>StructuredTool._injected_args_keys</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39602 ">#39602</a>)
feat(core): add standard model exception types (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39538 ">#39538</a>)
fix(core): allow deserializing <code>RunnablePick</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39753 ">#39753</a>)
fix(core): make <code>convert_to_openai_function</code> handle callables
and non-dict mappings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39750 ">#39750</a>)
fix(core): make subprocess and temporary file tests portable on Windows
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39664 ">#39664</a>)
fix(core): fail fast when tool schemas can't resolve forward refs during
serialization (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39570 ">#39570</a>)
test(core): avoid version-dependent runnable snapshots (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39705 ">#39705</a>)
fix(core): require all nested properties for strict tool schemas (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39306 ">#39306</a>)
fix(core): remove stale sync-stream <code>xfail</code> [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39720 ">#39720</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39723 ">#39723</a>)
perf(core): Lazily import transformers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38037 ">#38037</a>)
fix(core): accept non-dict Mapping values in mustache templates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39680 ">#39680</a>)
docs(core): clarify <code>Runnable</code> pipe coercion [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39075 ">#39075</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39707 ">#39707</a>)
fix(core): finalize chain-group runs on <code>BaseException</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39699 ">#39699</a>)</p>
<h2>langchain-core==1.5.6</h2>
<p>Changes since langchain-core==1.5.5</p>
<p>chore(core): release 1.5.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39704 ">#39704</a>)
feat(core): incorporate gateway metadata to traces (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39703 ">#39703</a>)</p>
<h2>langchain-core==1.5.5</h2>
<p>Changes since langchain-core==1.5.4</p>
<p>release(core): 1.5.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39655 ">#39655</a>)
fix(core): make abatch_iterate consistent with batch_iterate for None
and zero size (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39367 ">#39367</a>)
fix(core): respect pydantic aliases when validating tool inputs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39572 ">#39572</a>)
fix(core): issues in merging chunks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39535 ">#39535</a>)
fix(core): handle v1 base model validation in async path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39576 ">#39576</a>)
fix(core): handle tool descriptions for infer_schema=False (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39573 ">#39573</a>)
fix(core): clear usage metadata callback on exceptions in context
manager (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39616 ">#39616</a>)
fix(core): handle falsy LLM and chat model caches (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39283 ">#39283</a>)
chore(core): add httpx as an explicit dep (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39612 ">#39612</a>)
fix(core): preserve non-str/non-dict items in
<code>DictPromptTemplate</code> list values (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39588 ">#39588</a>)
fix(core): raise ValueError when explicit tool_outputs length mismatches
tool_calls in tool_example_to_messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39142 ">#39142</a>)
fix(core): guard malformed Anthropic content blocks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38670 ">#38670</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46 "><code>4fe9d30</code></a>
chore(openai): fix tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39972 ">#39972</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c "><code>8fa38dc</code></a>
revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372 "><code>122030d</code></a>
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b "><code>7d4b42b</code></a>
release(langchain): 1.3.18 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39966 ">#39966</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83 "><code>4a66e35</code></a>
fix(langchain): preserve content-block shape in PIIMiddleware redaction
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39894 ">#39894</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3 "><code>38e2113</code></a>
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e "><code>13b1b2f</code></a>
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26 "><code>3b3b308</code></a>
release(anthropic): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39963 ">#39963</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4 "><code>e3f6adf</code></a>
feat(anthropic): support top-level param for skills via
<code>container</code>; `updates...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa "><code>c253f54</code></a>
fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and
gpt-5.1 profiles...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.2...langchain-core==1.6.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `redis` from 8.0.1 to 8.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/redis/redis-py/releases ">redis's
releases</a>.</em></p>
<blockquote>
<h2>8.1.0</h2>
<h1>Changes</h1>
<h2>✨ Highlights</h2>
<h3>Async maintenance notifications</h3>
<p>redis-py now supports server-pushed <strong>maintenance
notifications</strong> in the asyncio stack for both
standalone and cluster clients, bringing the async client to parity with
the sync implementation.
When a Redis deployment signals maintenance events (such as node
migration or failover windows), the
async client reacts through the maintenance-notifications handler
(<code>redis/maint_notifications.py</code> and
its async integration under <code>redis/asyncio/</code>), allowing
applications to adapt connection handling
during maintenance without downtime. (<a
href="https://redirect.github.com/redis/redis-py/issues/4177 ">#4177</a>)</p>
<h3>Expanded command coverage</h3>
<p>This release adds a batch of new command surfaces across core data
types and modules:</p>
<ul>
<li><strong>Lists</strong> — <code>LMOVEM</code> / <code>BLMOVEM</code>
for moving multiple elements between lists (<a
href="https://redirect.github.com/redis/redis-py/issues/4174 ">#4174</a>).</li>
<li><strong>Sets</strong> — <code>SDIFFCARD</code> and
<code>SUNIONCARD</code> cardinality commands (<a
href="https://redirect.github.com/redis/redis-py/issues/4171 ">#4171</a>).</li>
<li><strong>Streams</strong> — <code>MAXCOUNT</code> /
<code>MAXSIZE</code> options for <code>XREAD</code> and
<code>XREADGROUP</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4173 ">#4173</a>).</li>
<li><strong>Time Series</strong> — <code>TS.READ</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4170 ">#4170</a>),
<code>TS.QUERYLABELS</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4197 ">#4197</a>),
<code>TS.NRANGE</code> / <code>TS.NREVRANGE</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4163 ">#4163</a>),
and an <code>exclude_empty</code> (<code>EXCLUDEEMPTY</code>) option for
<code>TS.MRANGE</code> / <code>TS.MREVRANGE</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4188 ">#4188</a>).</li>
<li><strong>Search</strong> — <code>FT.ALIASLIST</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)
and a <code>COLLECT</code> reducer for aggregations (<a
href="https://redirect.github.com/redis/redis-py/issues/4179 ">#4179</a>).</li>
<li><strong>Sentinel</strong> — replica sentinel aliases (<a
href="https://redirect.github.com/redis/redis-py/issues/4127 ">#4127</a>).</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>Add replica sentinel aliases (<a
href="https://redirect.github.com/redis/redis-py/issues/4127 ">#4127</a>)</li>
<li>Add TS.NRANGE and TS.NREVRANGE support to the timeseries command
surface (<a
href="https://redirect.github.com/redis/redis-py/issues/4163 ">#4163</a>)</li>
<li>feat: add TS.READ command support to the timeseries module (<a
href="https://redirect.github.com/redis/redis-py/issues/4170 ">#4170</a>)</li>
<li>feat: add SDIFFCARD and SUNIONCARD command support (<a
href="https://redirect.github.com/redis/redis-py/issues/4171 ">#4171</a>)</li>
<li>feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (<a
href="https://redirect.github.com/redis/redis-py/issues/4173 ">#4173</a>)</li>
<li>feat: add LMOVEM and BLMOVEM commands for moving multiple list
elements (<a
href="https://redirect.github.com/redis/redis-py/issues/4174 ">#4174</a>)</li>
<li>feat: add async maintenance-notifications support for standalone and
cluster clients (<a
href="https://redirect.github.com/redis/redis-py/issues/4177 ">#4177</a>)</li>
<li>feat: add COLLECT reducer support to search aggregations (<a
href="https://redirect.github.com/redis/redis-py/issues/4179 ">#4179</a>)</li>
<li>feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and
TS.MREVRANGE (<a
href="https://redirect.github.com/redis/redis-py/issues/4188 ">#4188</a>)</li>
<li>feat: add TS.QUERYLABELS support to the timeseries command surface
(<a
href="https://redirect.github.com/redis/redis-py/issues/4197 ">#4197</a>)</li>
<li>feat: add FT.ALIASLIST support (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)</li>
</ul>
<h2>⚠️ Experimental</h2>
<ul>
<li>feat: add client-side HIMPORT fieldset support for standalone and
cluster clients (<a
href="https://redirect.github.com/redis/redis-py/issues/4205 ">#4205</a>)</li>
</ul>
<p>The feature considered unstable and <strong>public API might be
changed in the future minor version</strong></p>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: detect closed pooled connection without consuming pending push
data (RESP3 + hiredis) (<a
href="https://redirect.github.com/redis/redis-py/issues/4156 ">#4156</a>)</li>
<li>Fix Sentinel pool capacity loss after failover (<a
href="https://redirect.github.com/redis/redis-py/issues/4193 ">#4193</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/redis/redis-py/commit/e013126df18e476fbb8b8215f040f39bd3242683 "><code>e013126</code></a>
Testing with 8.10 GA (<a
href="https://redirect.github.com/redis/redis-py/issues/4227 ">#4227</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/059d1e97d88dd7ed516628e0a9765ab8e0e299f1 "><code>059d1e9</code></a>
Fixed TS.NRANGE commands to correctly apply aggregators (<a
href="https://redirect.github.com/redis/redis-py/issues/4225 ">#4225</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/d486a0a982dcdf316006474dc286ca65cbec5a9f "><code>d486a0a</code></a>
Fix FIELDNAME alias dropping first character of un-prefixed fields (<a
href="https://redirect.github.com/redis/redis-py/issues/4224 ">#4224</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/fb931042420baaa5fbb9021955e444f7afa66dc2 "><code>fb93104</code></a>
feat: add client-side HIMPORT fieldset support for standalone and
cluster cli...</li>
<li><a
href="https://github.com/redis/redis-py/commit/9197609f48eb9713411a50534ca48210486a4bf9 "><code>9197609</code></a>
Fix lat/lon swap in search querystring geo() helper (<a
href="https://redirect.github.com/redis/redis-py/issues/4223 ">#4223</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/14714a0812d3ff03ad34c89ce6f79e287a04e9fb "><code>14714a0</code></a>
fix: Fixed double decoding issue with unquote() (<a
href="https://redirect.github.com/redis/redis-py/issues/4222 ">#4222</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/227280a939718d09ff9d7c41f9785ffdc21bdc2a "><code>227280a</code></a>
Update lib version to 8.1.0</li>
<li><a
href="https://github.com/redis/redis-py/commit/88d16d0db10c852d1d292628b2c832f1ed117056 "><code>88d16d0</code></a>
Decode ACL LOG string values on the default RESP3 legacy callback (<a
href="https://redirect.github.com/redis/redis-py/issues/4201 ">#4201</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/599fd75ca7d0745928280ff3a64ccd224dbf2b76 "><code>599fd75</code></a>
feat: add FT.ALIASLIST support (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/71e275e6eae94d202b49bccce10ef0d2a59050e7 "><code>71e275e</code></a>
test: add VectorField RERANK serialization tests for sync and async
search (#...</li>
<li>Additional commits viewable in <a
href="https://github.com/redis/redis-py/compare/v8.0.1...v8.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73 )
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-02 09:45:10 +00:00
bbd6e2da0b
chore(deps-dev): bump syrupy from 5.5.3 to 6.0.0 in /libs/prebuilt in the major group ( #8780 )
...
Bumps the major group in /libs/prebuilt with 1 update:
[syrupy](https://github.com/syrupy-project/syrupy ).
Updates `syrupy` from 5.5.3 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h1>Syrupy 6.0.0</h1>
<p><em>(2026-08-22)</em></p>
<p>Syrupy 6 focuses on better built-in serialization, clearer snapshot
workflows, and large-suite performance. Please review the
<strong>breaking changes</strong> before upgrading.</p>
<p>Most suites should not need significant snapshot updates on upgrade —
the main exception is <strong>dataclass</strong> usage (see below).
Syrupy v6 does <strong>not</strong> change the required Python version
or other package dependencies. Support for Python 3.10 will instead be
dropped in the next Syrupy major version (v7).</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 ">https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 </a></p>
<hr />
<h2>Breaking Changes</h2>
<h3>Built-in dataclass serialization (removed
<code>DataclassPlugin</code>)</h3>
<p>stdlib dataclasses are now serialized natively by the Amber
serializer. The separate <code>DataclassPlugin</code> has been
<strong>removed</strong>.</p>
<ul>
<li><strong>If you used <code>DataclassPlugin</code>:</strong> remove
imports and plugin wiring. Behavior should match what the plugin
produced; no snapshot rewrite should be needed for the dataclass shape
itself.</li>
<li><strong>If you did <em>not</em> use the plugin:</strong> dataclass
snapshots may change from a <code>repr</code>-style string to structured
Amber form (field-by-field). Re-run with <code>--snapshot-update</code>
where those assertions fail.</li>
</ul>
<p>Example of what to remove:</p>
<pre lang="python"><code># Before (v5)
from syrupy.extensions.amber.dataclasses_plugin import DataclassPlugin
<p>class MySerializer(AmberDataSerializer):
serializer_plugins = [DataclassPlugin, ...]
</code></pre></p>
<pre lang="python"><code># After (v6) — dataclasses work with the
default Amber extension
assert MyDataclass(...) == snapshot
</code></pre>
<p>Attrs and Pydantic models are unchanged and still need their
serializer plugins. See the <a
href="https://github.com/syrupy-project/syrupy/blob/main/tests/syrupy/extensions/amber/test_amber_serializer_plugins.py ">serializer
plugins example</a>.</p>
<p>(<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1220 ">#1220</a>,
closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1048 ">#1048</a>)</p>
<h3>JSON <code>datetime.date</code> snapshots</h3>
<p>The JSON extension now serializes <code>datetime.date</code> as
<code>YYYY-MM-DD</code> instead of a <code>repr</code> string. Existing
JSON snapshots that contain dates will need an update.</p>
<p>(<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1216 ">#1216</a>,
closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1058 ">#1058</a>)</p>
<h3><code>path_value</code> nested path replacement in default (literal)
mode</h3>
<p><code>path_value(..., regex=False)</code> now correctly replaces
values at nested paths such as <code>user.token</code>. Previously, the
default-mode lookup missed escaped path keys, so nested values were left
unchanged (and could leak into committed snapshots).</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.0.0 ">v6.0.0</a>
(2026-08-22)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump pygments from 2.19.2 to 2.20.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1151 ">syrupy-project/syrupy#1151</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1152 ">syrupy-project/syrupy#1152</a></li>
<li>chore(deps): update dependency ruff to v0.15.21 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1153 ">syrupy-project/syrupy#1153</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1154 ">syrupy-project/syrupy#1154</a></li>
<li>chore(deps): update dependency coverage to v7.15.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1157 ">syrupy-project/syrupy#1157</a></li>
<li>chore(deps): update dependency mypy to v2.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1158 ">syrupy-project/syrupy#1158</a></li>
<li>fix: make set/dict serialization deterministic for partial-order
elements by <a
href="https://github.com/chuenchen309 "><code>@chuenchen309</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1159 ">syrupy-project/syrupy#1159</a></li>
<li>docs: add chuenchen309 as a contributor for bug by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1160 ">syrupy-project/syrupy#1160</a></li>
<li>chore(deps): update dependency coverage to v7.15.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1163 ">syrupy-project/syrupy#1163</a></li>
<li>chore(deps): update dependency ruff to v0.15.22 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1164 ">syrupy-project/syrupy#1164</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1165 ">syrupy-project/syrupy#1165</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.9 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1166 ">syrupy-project/syrupy#1166</a></li>
<li>chore(deps): update dependency hypothesis to v6.157.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1167 ">syrupy-project/syrupy#1167</a></li>
<li>fix(matchers): replace values at nested paths in path_value default
mode by <a
href="https://github.com/chuenchen309 "><code>@chuenchen309</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1162 ">syrupy-project/syrupy#1162</a></li>
<li>fix: preserve skipped single-file snapshots by <a
href="https://github.com/KSmanis "><code>@KSmanis</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1161 ">syrupy-project/syrupy#1161</a></li>
<li>docs: add KSmanis as a contributor for bug by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1168 ">syrupy-project/syrupy#1168</a></li>
<li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.1 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1169 ">syrupy-project/syrupy#1169</a></li>
<li>chore(deps): update dependency hypothesis to v6.157.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1171 ">syrupy-project/syrupy#1171</a></li>
<li>chore(deps): update actions/checkout action to v7.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1170 ">syrupy-project/syrupy#1170</a></li>
<li>chore(deps): update dependency hypothesis to v6.158.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1172 ">syrupy-project/syrupy#1172</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v9 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1174 ">syrupy-project/syrupy#1174</a></li>
<li>chore(deps): update dependency hypothesis to v6.158.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1173 ">syrupy-project/syrupy#1173</a></li>
<li>chore(deps): update dependency hypothesis to v6.160.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1176 ">syrupy-project/syrupy#1176</a></li>
<li>feat: support in-memory snapshot diff data by <a
href="https://github.com/yangfan-yf-yf "><code>@yangfan-yf-yf</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1175 ">syrupy-project/syrupy#1175</a></li>
<li>docs: add yangfan-yf-yf as a contributor for code by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1178 ">syrupy-project/syrupy#1178</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1177 ">syrupy-project/syrupy#1177</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1180 ">syrupy-project/syrupy#1180</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1182 ">syrupy-project/syrupy#1182</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1183 ">syrupy-project/syrupy#1183</a></li>
<li>chore(deps): update dependency ruff to >=0.16,<0.17 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1179 ">syrupy-project/syrupy#1179</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1184 ">syrupy-project/syrupy#1184</a></li>
<li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.2 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1186 ">syrupy-project/syrupy#1186</a></li>
<li>perf: compress xdist snapshot reports by <a
href="https://github.com/w3lld1 "><code>@w3lld1</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1188 ">syrupy-project/syrupy#1188</a></li>
<li>docs: add w3lld1 as a contributor for code by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1190 ">syrupy-project/syrupy#1190</a></li>
<li>chore(deps): update dependency ruff to v0.16.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1189 ">syrupy-project/syrupy#1189</a></li>
<li>chore(deps): update dependency hypothesis to v6.164.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1187 ">syrupy-project/syrupy#1187</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1191 ">syrupy-project/syrupy#1191</a></li>
<li>chore(deps): update dependency coverage to v7.15.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1192 ">syrupy-project/syrupy#1192</a></li>
<li>chore(deps): update python docker tag to v3.14.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1195 ">syrupy-project/syrupy#1195</a></li>
<li>chore(deps): update dependency coverage to v7.15.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1197 ">syrupy-project/syrupy#1197</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1194 ">syrupy-project/syrupy#1194</a></li>
<li>chore(deps): update dependency ruff to v0.16.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1198 ">syrupy-project/syrupy#1198</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1199 ">syrupy-project/syrupy#1199</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v10 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1200 ">syrupy-project/syrupy#1200</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1201 ">syrupy-project/syrupy#1201</a></li>
<li>chore(deps): update dependency ruff to v0.16.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1202 ">syrupy-project/syrupy#1202</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v10.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1205 ">syrupy-project/syrupy#1205</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/621af75dd8dfa3301b503099b204a3d874e787d7 "><code>621af75</code></a>
chore(release): 6.0.0 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3a9f69182366401c372dd0a1690177e70e994fec "><code>3a9f691</code></a>
fix: single file snapshot no longer buffers in memory (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1223 ">#1223</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/ab13f8d4a9eeba10572a6a12f485f79a6e0a1b23 "><code>ab13f8d</code></a>
chore: sponsorship (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1224 ">#1224</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/98f989c42a7c1c9cf49e031e9b97374bf97a6b6d "><code>98f989c</code></a>
feat: add --snapshot-declaration-order for respecting declaration order
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1222 ">#1222</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/b549b4b6329cca03f871162748b3ea8597add1a3 "><code>b549b4b</code></a>
feat: built-in support for Dataclasses (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1220 ">#1220</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/d34933fce2d8eb65c24a89f29f5900b413775b5e "><code>d34933f</code></a>
chore: use the benchmarks git branch (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1221 ">#1221</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/f6eda020d8671fc1648c0d94ed436805d5548978 "><code>f6eda02</code></a>
chore(ci): permissions for gh-pages</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/a5ce0492e68525f499f5cb395e273d3ac5a1f8e3 "><code>a5ce049</code></a>
chore(deps): update actions/configure-pages action to v6 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1219 ">#1219</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/c0cb162f5fbaca6eeda43937152db314e0313c82 "><code>c0cb162</code></a>
chore: update github pages</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4d59bde91c87f6a2fb3b476ea995246a43449bc2 "><code>4d59bde</code></a>
chore: update docs for v6 release (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1218 ">#1218</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73 )
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-09-02 09:40:09 +00:00
dependabot[bot]
b7bcf0083c
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph ( #8792 )
...
Bumps [tornado](https://github.com/tornadoweb/tornado ) from 6.5.7 to
6.5.8.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst ">tornado's
changelog</a>.</em></p>
<blockquote>
<h1>Release notes</h1>
<p>.. toctree::
:maxdepth: 2</p>
<p>releases/v6.5.8
releases/v6.5.7
releases/v6.5.6
releases/v6.5.5
releases/v6.5.4
releases/v6.5.3
releases/v6.5.2
releases/v6.5.1
releases/v6.5.0
releases/v6.4.2
releases/v6.4.1
releases/v6.4.0
releases/v6.3.3
releases/v6.3.2
releases/v6.3.1
releases/v6.3.0
releases/v6.2.0
releases/v6.1.0
releases/v6.0.4
releases/v6.0.3
releases/v6.0.2
releases/v6.0.1
releases/v6.0.0
releases/v5.1.1
releases/v5.1.0
releases/v5.0.2
releases/v5.0.1
releases/v5.0.0
releases/v4.5.3
releases/v4.5.2
releases/v4.5.1
releases/v4.5.0
releases/v4.4.3
releases/v4.4.2
releases/v4.4.1
releases/v4.4.0
releases/v4.3.0
releases/v4.2.1
releases/v4.2.0
releases/v4.1.0
releases/v4.0.2
releases/v4.0.1
releases/v4.0.0
releases/v3.2.2</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tornadoweb/tornado/commit/a55abe3e3bf59994f29b2f7084c46341f0d4f6a7 "><code>a55abe3</code></a>
Merge pull request <a
href="https://redirect.github.com/tornadoweb/tornado/issues/3704 ">#3704</a>
from bdarnell/security-6.5.8</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/fc794885f0ccf9c33f3a66d890abcc237dd50b3c "><code>fc79488</code></a>
docs: add additional credit to release notes</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/7b017630d3139ca0d1ebdf6ac3b3ffe7725a7129 "><code>7b01763</code></a>
Fix test_strip_headers_on_redirect's URL-embedded-credentials cases</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/d72fff8d7b9b8f6aa68505847e5483d600e3184c "><code>d72fff8</code></a>
release notes and version bump for 6.5.8</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/b168818f8aae39808b981878fb358cbe02a6238e "><code>b168818</code></a>
auth: Formally deprecated OpenIDMixin</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7 "><code>da28476</code></a>
web: Also check for semicolons in deprecated mixed-case cookie args</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de "><code>8d6363e</code></a>
httputil: Enforce a new limit on the number of arguments in a
request</li>
<li><a
href="https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05 "><code>de85b3f</code></a>
httputil: Apply multipart max_parts limit earlier</li>
<li>See full diff in <a
href="https://github.com/tornadoweb/tornado/compare/v6.5.7...v6.5.8 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:13:17 -07:00
dependabot[bot]
7815573c76
chore(deps): bump the major group in /libs/langgraph with 2 updates ( #8783 )
...
Bumps the major group in /libs/langgraph with 2 updates:
[xxhash](https://github.com/ifduyue/python-xxhash ) and
[syrupy](https://github.com/syrupy-project/syrupy ).
Updates `xxhash` from 3.8.1 to 4.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/releases ">xxhash's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.1</h2>
<ul>
<li>Clean up <code>_parse_init_args</code> keyword handling so the
defensive check
for a duplicate <code>data</code> keyword raises a proper error
message</li>
<li>Add <code>_xxhash</code> module docstring</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ifduyue/python-xxhash/compare/v4.0.0...v4.0.1 ">https://github.com/ifduyue/python-xxhash/compare/v4.0.0...v4.0.1 </a></p>
<h2>v4.0.0</h2>
<ul>
<li><strong>Breaking change</strong>: Drop support for Python 3.8,
require Python >= 3.9</li>
<li><strong>Breaking change</strong>: Remove deprecated
<code>xxhash.VERSION_TUPLE</code></li>
<li><strong>Breaking change</strong>: The <code>input</code> keyword
argument is renamed to <code>data</code>
across constructors, <code>update()</code>, and one-shot functions</li>
<li><strong>Breaking change</strong>: <code>str</code> input is no
longer accepted and raises
<code>TypeError: Strings must be encoded before hashing</code>; encode
to
<code>bytes</code> before hashing</li>
<li>Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source
builds
that target AVX2 (e.g. <code>-march=x86-64-v3</code>), upstream v0.8.3
autovectorizes <code>XXH64_update()</code> and makes the xxh64 streaming
path
about 2x slower. The shipped wheels are built for baseline x86-64 and
are unaffected. Source builds can work around it by adding
<code>-fno-tree-vectorize</code> to the compiler flags.</li>
<li>Add per-object locking for thread safety, with sub-interpreter and
free-threaded (no-GIL) Python support</li>
<li>Speed up hash constructors by switching them to
<code>tp_vectorcall</code>.</li>
<li>Build pyodide wasm32 wheels</li>
<li>Add s390x big-endian test job</li>
<li>Add Python 3.15 classifier</li>
<li>CI: shard the PyPI upload into parallel groups and create the GitHub
Release automatically</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst ">xxhash's
changelog</a>.</em></p>
<blockquote>
<p>v4.0.1 2026-08-17</p>
<pre><code>
- Clean up ``_parse_init_args`` keyword handling so the defensive check
for a duplicate ``data`` keyword raises a proper error message
- Add ``_xxhash`` module docstring
<p>v4.0.0 2026-08-12<br />
</code></pre></p>
<ul>
<li><strong>Breaking change</strong>: Drop support for Python 3.8,
require Python >= 3.9</li>
<li><strong>Breaking change</strong>: Remove deprecated
<code>xxhash.VERSION_TUPLE</code></li>
<li><strong>Breaking change</strong>: The <code>input</code> keyword
argument is renamed to <code>data</code>
in constructors and one-shot functions. <code>update()</code>
additionally gains a
<code>data</code> keyword argument (it accepted no keyword arguments
before).</li>
<li><strong>Breaking change</strong>: <code>str</code> input is no
longer accepted and raises
<code>TypeError: Strings must be encoded before hashing</code>; encode
to
<code>bytes</code> before hashing</li>
<li>Upgrade xxHash from v0.8.2 to v0.8.3. Note: on GCC/Clang source
builds
that target AVX2 (e.g. <code>-march=x86-64-v3</code>), upstream v0.8.3
autovectorizes <code>XXH64_update()</code> and makes the xxh64 streaming
path
about 2x slower. The shipped wheels are built for baseline x86-64 and
are unaffected. Source builds can work around it by adding
<code>-fno-tree-vectorize</code> to the compiler flags.</li>
<li>Add per-object locking for thread safety, with sub-interpreter and
free-threaded (no-GIL) Python support. The GIL is now released only
while hashing inputs larger than 64 KiB; previously
<code>update()</code>
released it unconditionally and one-shot functions always held it.</li>
<li>Speed up hash constructors by switching them to
<code>tp_vectorcall</code>.</li>
<li>Build pyodide wasm32 wheels</li>
<li>Add s390x big-endian test job</li>
<li>Add Python 3.15 classifier</li>
<li>CI: shard the PyPI upload into parallel groups and create the GitHub
Release automatically</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/e2c1bcf1e1d86c4e3d43e4d412dccb521498ea88 "><code>e2c1bcf</code></a>
Release v4.0.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/669a69c0d367a93f2305b45d407d89e8cad7c319 "><code>669a69c</code></a>
Clean up _parse_init_args keyword handling</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/4a6136daf73f3363ff82e50efd93e8c9c225c153 "><code>4a6136d</code></a>
build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa26ed65c95eed5606082994ed5a05856cac3e51 "><code>aa26ed6</code></a>
Bump version to 4.0.1.dev0</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/d774e2a1bb561fa9de58b6c7127f58e075da4e4a "><code>d774e2a</code></a>
Add _xxhash module docstring</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/c8d9a0e11758ed89a5eadd5c6c24eca269dfe56c "><code>c8d9a0e</code></a>
Clarify changelog: update() keyword and GIL release threshold</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/80d42d28d66cdd5626d50d267a998885611e2956 "><code>80d42d2</code></a>
Mention exact str rejection error in changelog</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/befdf3b7ff0e7c9acff660f2069a7065363ce7e5 "><code>befdf3b</code></a>
Update changelog: note str input rejection</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/5c5e42fee161c036ab0382194e0cbdadc8fe7e9b "><code>5c5e42f</code></a>
Release v4.0.0</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/88fe1916410814eecbb16c7a771ec570f3aec5ec "><code>88fe191</code></a>
Bump version to 4.0.0.dev8</li>
<li>Additional commits viewable in <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.1...v4.0.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 5.5.3 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h1>Syrupy 6.0.0</h1>
<p><em>(2026-08-22)</em></p>
<p>Syrupy 6 focuses on better built-in serialization, clearer snapshot
workflows, and large-suite performance. Please review the
<strong>breaking changes</strong> before upgrading.</p>
<p>Most suites should not need significant snapshot updates on upgrade —
the main exception is <strong>dataclass</strong> usage (see below).
Syrupy v6 does <strong>not</strong> change the required Python version
or other package dependencies. Support for Python 3.10 will instead be
dropped in the next Syrupy major version (v7).</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 ">https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 </a></p>
<hr />
<h2>Breaking Changes</h2>
<h3>Built-in dataclass serialization (removed
<code>DataclassPlugin</code>)</h3>
<p>stdlib dataclasses are now serialized natively by the Amber
serializer. The separate <code>DataclassPlugin</code> has been
<strong>removed</strong>.</p>
<ul>
<li><strong>If you used <code>DataclassPlugin</code>:</strong> remove
imports and plugin wiring. Behavior should match what the plugin
produced; no snapshot rewrite should be needed for the dataclass shape
itself.</li>
<li><strong>If you did <em>not</em> use the plugin:</strong> dataclass
snapshots may change from a <code>repr</code>-style string to structured
Amber form (field-by-field). Re-run with <code>--snapshot-update</code>
where those assertions fail.</li>
</ul>
<p>Example of what to remove:</p>
<pre lang="python"><code># Before (v5)
from syrupy.extensions.amber.dataclasses_plugin import DataclassPlugin
<p>class MySerializer(AmberDataSerializer):
serializer_plugins = [DataclassPlugin, ...]
</code></pre></p>
<pre lang="python"><code># After (v6) — dataclasses work with the
default Amber extension
assert MyDataclass(...) == snapshot
</code></pre>
<p>Attrs and Pydantic models are unchanged and still need their
serializer plugins. See the <a
href="https://github.com/syrupy-project/syrupy/blob/main/tests/syrupy/extensions/amber/test_amber_serializer_plugins.py ">serializer
plugins example</a>.</p>
<p>(<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1220 ">#1220</a>,
closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1048 ">#1048</a>)</p>
<h3>JSON <code>datetime.date</code> snapshots</h3>
<p>The JSON extension now serializes <code>datetime.date</code> as
<code>YYYY-MM-DD</code> instead of a <code>repr</code> string. Existing
JSON snapshots that contain dates will need an update.</p>
<p>(<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1216 ">#1216</a>,
closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1058 ">#1058</a>)</p>
<h3><code>path_value</code> nested path replacement in default (literal)
mode</h3>
<p><code>path_value(..., regex=False)</code> now correctly replaces
values at nested paths such as <code>user.token</code>. Previously, the
default-mode lookup missed escaped path keys, so nested values were left
unchanged (and could leak into committed snapshots).</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v6.0.0 ">v6.0.0</a>
(2026-08-22)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump pygments from 2.19.2 to 2.20.0 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1151 ">syrupy-project/syrupy#1151</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1152 ">syrupy-project/syrupy#1152</a></li>
<li>chore(deps): update dependency ruff to v0.15.21 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1153 ">syrupy-project/syrupy#1153</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1154 ">syrupy-project/syrupy#1154</a></li>
<li>chore(deps): update dependency coverage to v7.15.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1157 ">syrupy-project/syrupy#1157</a></li>
<li>chore(deps): update dependency mypy to v2.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1158 ">syrupy-project/syrupy#1158</a></li>
<li>fix: make set/dict serialization deterministic for partial-order
elements by <a
href="https://github.com/chuenchen309 "><code>@chuenchen309</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1159 ">syrupy-project/syrupy#1159</a></li>
<li>docs: add chuenchen309 as a contributor for bug by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1160 ">syrupy-project/syrupy#1160</a></li>
<li>chore(deps): update dependency coverage to v7.15.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1163 ">syrupy-project/syrupy#1163</a></li>
<li>chore(deps): update dependency ruff to v0.15.22 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1164 ">syrupy-project/syrupy#1164</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1165 ">syrupy-project/syrupy#1165</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.9 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1166 ">syrupy-project/syrupy#1166</a></li>
<li>chore(deps): update dependency hypothesis to v6.157.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1167 ">syrupy-project/syrupy#1167</a></li>
<li>fix(matchers): replace values at nested paths in path_value default
mode by <a
href="https://github.com/chuenchen309 "><code>@chuenchen309</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1162 ">syrupy-project/syrupy#1162</a></li>
<li>fix: preserve skipped single-file snapshots by <a
href="https://github.com/KSmanis "><code>@KSmanis</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1161 ">syrupy-project/syrupy#1161</a></li>
<li>docs: add KSmanis as a contributor for bug by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1168 ">syrupy-project/syrupy#1168</a></li>
<li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.1 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1169 ">syrupy-project/syrupy#1169</a></li>
<li>chore(deps): update dependency hypothesis to v6.157.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1171 ">syrupy-project/syrupy#1171</a></li>
<li>chore(deps): update actions/checkout action to v7.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1170 ">syrupy-project/syrupy#1170</a></li>
<li>chore(deps): update dependency hypothesis to v6.158.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1172 ">syrupy-project/syrupy#1172</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v9 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1174 ">syrupy-project/syrupy#1174</a></li>
<li>chore(deps): update dependency hypothesis to v6.158.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1173 ">syrupy-project/syrupy#1173</a></li>
<li>chore(deps): update dependency hypothesis to v6.160.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1176 ">syrupy-project/syrupy#1176</a></li>
<li>feat: support in-memory snapshot diff data by <a
href="https://github.com/yangfan-yf-yf "><code>@yangfan-yf-yf</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1175 ">syrupy-project/syrupy#1175</a></li>
<li>docs: add yangfan-yf-yf as a contributor for code by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1178 ">syrupy-project/syrupy#1178</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1177 ">syrupy-project/syrupy#1177</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1180 ">syrupy-project/syrupy#1180</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1182 ">syrupy-project/syrupy#1182</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.6 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1183 ">syrupy-project/syrupy#1183</a></li>
<li>chore(deps): update dependency ruff to >=0.16,<0.17 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1179 ">syrupy-project/syrupy#1179</a></li>
<li>chore(deps): update dependency hypothesis to v6.161.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1184 ">syrupy-project/syrupy#1184</a></li>
<li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.2 by
<a href="https://github.com/renovate "><code>@renovate</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1186 ">syrupy-project/syrupy#1186</a></li>
<li>perf: compress xdist snapshot reports by <a
href="https://github.com/w3lld1 "><code>@w3lld1</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1188 ">syrupy-project/syrupy#1188</a></li>
<li>docs: add w3lld1 as a contributor for code by <a
href="https://github.com/allcontributors "><code>@allcontributors</code></a>[bot]
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1190 ">syrupy-project/syrupy#1190</a></li>
<li>chore(deps): update dependency ruff to v0.16.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1189 ">syrupy-project/syrupy#1189</a></li>
<li>chore(deps): update dependency hypothesis to v6.164.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1187 ">syrupy-project/syrupy#1187</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1191 ">syrupy-project/syrupy#1191</a></li>
<li>chore(deps): update dependency coverage to v7.15.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1192 ">syrupy-project/syrupy#1192</a></li>
<li>chore(deps): update python docker tag to v3.14.7 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1195 ">syrupy-project/syrupy#1195</a></li>
<li>chore(deps): update dependency coverage to v7.15.4 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1197 ">syrupy-project/syrupy#1197</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1194 ">syrupy-project/syrupy#1194</a></li>
<li>chore(deps): update dependency ruff to v0.16.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1198 ">syrupy-project/syrupy#1198</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1199 ">syrupy-project/syrupy#1199</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v10 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1200 ">syrupy-project/syrupy#1200</a></li>
<li>chore(deps): update dependency hypothesis to v6.165.5 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1201 ">syrupy-project/syrupy#1201</a></li>
<li>chore(deps): update dependency ruff to v0.16.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1202 ">syrupy-project/syrupy#1202</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v10.0.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1205 ">syrupy-project/syrupy#1205</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/621af75dd8dfa3301b503099b204a3d874e787d7 "><code>621af75</code></a>
chore(release): 6.0.0 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3a9f69182366401c372dd0a1690177e70e994fec "><code>3a9f691</code></a>
fix: single file snapshot no longer buffers in memory (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1223 ">#1223</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/ab13f8d4a9eeba10572a6a12f485f79a6e0a1b23 "><code>ab13f8d</code></a>
chore: sponsorship (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1224 ">#1224</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/98f989c42a7c1c9cf49e031e9b97374bf97a6b6d "><code>98f989c</code></a>
feat: add --snapshot-declaration-order for respecting declaration order
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1222 ">#1222</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/b549b4b6329cca03f871162748b3ea8597add1a3 "><code>b549b4b</code></a>
feat: built-in support for Dataclasses (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1220 ">#1220</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/d34933fce2d8eb65c24a89f29f5900b413775b5e "><code>d34933f</code></a>
chore: use the benchmarks git branch (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1221 ">#1221</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/f6eda020d8671fc1648c0d94ed436805d5548978 "><code>f6eda02</code></a>
chore(ci): permissions for gh-pages</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/a5ce0492e68525f499f5cb395e273d3ac5a1f8e3 "><code>a5ce049</code></a>
chore(deps): update actions/configure-pages action to v6 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1219 ">#1219</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/c0cb162f5fbaca6eeda43937152db314e0313c82 "><code>c0cb162</code></a>
chore: update github pages</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4d59bde91c87f6a2fb3b476ea995246a43449bc2 "><code>4d59bde</code></a>
chore: update docs for v6 release (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1218 ">#1218</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:12:29 -07:00
dependabot[bot]
0cf2f960f6
chore(deps): bump the minor-and-patch group in /libs/cli with 6 updates ( #8778 )
...
Bumps the minor-and-patch group in /libs/cli with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [click](https://github.com/pallets/click ) | `8.4.2` | `8.5.0` |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph ) | `0.4.2` |
`0.4.4` |
| [python-dotenv](https://github.com/theskumar/python-dotenv ) | `1.2.2`
| `1.2.3` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.16.0` | `0.16.5` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.64` | `0.0.75` |
| [hatch](https://github.com/pypa/hatch ) | `1.17.1` | `1.18.0` |
Updates `click` from 8.4.2 to 8.5.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/click/releases ">click's
releases</a>.</em></p>
<blockquote>
<h2>8.5.0</h2>
<p>This is the Click 8.5.0 feature release. A feature release may
include new features, remove previously deprecated code, add new
deprecation, or introduce potentially breaking changes.</p>
<p>We encourage everyone to upgrade. You can read more about our <a
href="https://palletsprojects.com/versions ">Version Support Policy</a>
on our website.</p>
<p>PyPI: <a
href="https://pypi.org/project/click/8.5.0/ ">https://pypi.org/project/click/8.5.0/ </a>
Changes: <a
href="https://click.palletsprojects.com/page/changes/#version-8-5-0 ">https://click.palletsprojects.com/page/changes/#version-8-5-0 </a>
Milestone <a
href="https://github.com/pallets/click/milestone/33 ">https://github.com/pallets/click/milestone/33 </a></p>
<ul>
<li>Add built-in shell completion support for PowerShell (Windows
PowerShell
5.1+ and pwsh 7+) alongside the existing <code>bash</code>,
<code>zsh</code>, and <code>fish</code>
completers. Use <code>_FOO_BAR_COMPLETE=powershell_source foo-bar</code>
to generate
the completion script. <a
href="https://redirect.github.com/pallets/click/issues/2672 ">#2672</a>
<a
href="https://redirect.github.com/pallets/click/issues/3637 ">#3637</a></li>
<li>Supported versions of Windows enable ANSI terminal styles by
default.
Colorama is no longer a dependency and is not used. <a
href="https://redirect.github.com/pallets/click/issues/2986 ">#2986</a>
<a
href="https://redirect.github.com/pallets/click/issues/3505 ">#3505</a></li>
<li>{class}<code>Argument</code> accepts a <code>help</code> parameter,
and help output includes
a <code>Positional arguments</code> section when argument help is
available. <a
href="https://redirect.github.com/pallets/click/issues/2983 ">#2983</a>
<a
href="https://redirect.github.com/pallets/click/issues/3473 ">#3473</a></li>
<li><code>confirm()</code> and <code>prompt()</code> strip ANSI color
and style codes from the
prompt when the output stream does not support them, matching
<code>echo()</code>.
This stripping was lost in <code>8.4.0</code> when <a
href="https://redirect.github.com/pallets/click/issues/2969 ">#2969</a>
began writing the
prompt with <code>input()</code> directly. <a
href="https://redirect.github.com/pallets/click/issues/3572 ">#3572</a>
<a
href="https://redirect.github.com/pallets/click/issues/3653 ">#3653</a></li>
<li>{class}<code>Path</code> with <code>allow_dash=True</code> no longer
triggers a <code>BytesWarning</code>,
an error under <code>python -bb</code>, when checking a value against
the <code>-</code>
convention. <a
href="https://redirect.github.com/pallets/click/issues/2877 ">#2877</a>
<a
href="https://redirect.github.com/pallets/click/issues/3642 ">#3642</a></li>
<li>Add {func}<code>custom_version_option</code>, a
<code>--version</code> option whose output is
produced by a callback, covering cases {func}<code>version_option</code>
intentionally
does not. The feature set of {func}<code>version_option</code> is now
frozen; see
[discussion <a
href="https://redirect.github.com/pallets/click/issues/3527 ">#3527</a>](<a
href="https://github.com/pallets/click/discussions/3527 ">https://github.com/pallets/click/discussions/3527 </a>).
<a
href="https://redirect.github.com/pallets/click/issues/3581 ">#3581</a></li>
<li><code>style()</code> and <code>secho()</code> no longer silently
drop the 256-color index <code>0</code>
(black) passed as <code>fg</code> or <code>bg</code>, and now validate
color arguments. Invalid
colors raise a <code>ValueError</code> instead of a
<code>TypeError</code>. <a
href="https://redirect.github.com/pallets/click/issues/3677 ">#3677</a></li>
<li>The automatic help option stores its value under the reserved name
<code>_click_default_help</code> instead of <code>help</code>, so a
parameter named <code>help</code> no
longer breaks parsing. The new name is visible in
{meth}<code>Command.to_info_dict</code> output. Parameters that
overwrite each other's
value trigger a warning: an argument sharing its name with another
parameter, or any parameter claiming the reserved name. Options may
still
share a name to compete for the same value (feature switches).
<a
href="https://redirect.github.com/pallets/click/issues/2819 ">#2819</a>
<a
href="https://redirect.github.com/pallets/click/issues/3678 ">#3678</a></li>
<li><code>unstyle</code> and the ANSI handling behind help-text wrapping
now strip the full
CSI escape-sequence grammar. <a
href="https://redirect.github.com/pallets/click/issues/3681 ">#3681</a></li>
<li>Streamline <code>Option</code> flag handling: the flag-kind, type,
lazy-default and
validation steps in <code>Option.__init__</code> move into focused
helpers, and
<code>flag_value</code> and <code>default</code> keep their unset
sentinel at construction
(resolved lazily on read) so <code>is UNSET</code> reliably tells a
user-supplied value
from an auto-derived one. Runtime behavior is unchanged, but
{meth}<code>Parameter.to_info_dict</code> now resolves
<code>default=True</code> on a feature
switch to its <code>flag_value</code>, matching what the function
receives at call</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/click/blob/main/CHANGES.md ">click's
changelog</a>.</em></p>
<blockquote>
<h2>Version 8.5.0</h2>
<p>Released 2026-08-24</p>
<ul>
<li>Add built-in shell completion support for PowerShell (Windows
PowerShell
5.1+ and pwsh 7+) alongside the existing <code>bash</code>,
<code>zsh</code>, and <code>fish</code>
completers. Use <code>_FOO_BAR_COMPLETE=powershell_source foo-bar</code>
to generate
the completion script. {issue}<code>2672</code>
{pr}<code>3637</code></li>
<li>Supported versions of Windows enable ANSI terminal styles by
default.
Colorama is no longer a dependency and is not used.
{issue}<code>2986</code> {pr}<code>3505</code></li>
<li>{class}<code>Argument</code> accepts a <code>help</code> parameter,
and help output includes
a <code>Positional arguments</code> section when argument help is
available. {issue}<code>2983</code> {pr}<code>3473</code></li>
<li><code>confirm()</code> and <code>prompt()</code> strip ANSI color
and style codes from the
prompt when the output stream does not support them, matching
<code>echo()</code>.
This stripping was lost in <code>8.4.0</code> when {pr}<code>2969</code>
began writing the
prompt with <code>input()</code> directly. {issue}<code>3572</code>
{pr}<code>3653</code></li>
<li>Fix test failures when using pytest >= 9.1.
{pr}<code>3656</code></li>
<li>{class}<code>Path</code> with <code>allow_dash=True</code> no longer
triggers a <code>BytesWarning</code>,
an error under <code>python -bb</code>, when checking a value against
the <code>-</code>
convention. {issue}<code>2877</code> {pr}<code>3642</code></li>
<li>Add {func}<code>custom_version_option</code>, a
<code>--version</code> option whose output is
produced by a callback, covering cases {func}<code>version_option</code>
intentionally
does not. The feature set of {func}<code>version_option</code> is now
frozen; see
[discussion <a
href="https://redirect.github.com/pallets/click/issues/3527 ">#3527</a>](<a
href="https://github.com/pallets/click/discussions/3527 ">https://github.com/pallets/click/discussions/3527 </a>).
{pr}<code>3581</code></li>
<li><code>style()</code> and <code>secho()</code> no longer silently
drop the 256-color index <code>0</code>
(black) passed as <code>fg</code> or <code>bg</code>, and now validate
color arguments. Invalid
colors raise a <code>ValueError</code> instead of a
<code>TypeError</code>. {pr}<code>3677</code></li>
<li>The automatic help option stores its value under the reserved name
<code>_click_default_help</code> instead of <code>help</code>, so a
parameter named <code>help</code> no
longer breaks parsing. The new name is visible in
{meth}<code>Command.to_info_dict</code> output. Parameters that
overwrite each other's
value trigger a warning: an argument sharing its name with another
parameter, or any parameter claiming the reserved name. Options may
still
share a name to compete for the same value (feature switches).
{issue}<code>2819</code> {pr}<code>3678</code></li>
<li><code>unstyle</code> and the ANSI handling behind help-text wrapping
now strip the full
CSI escape-sequence grammar. {pr}<code>3681</code></li>
<li>Streamline <code>Option</code> flag handling: the flag-kind, type,
lazy-default and
validation steps in <code>Option.__init__</code> move into focused
helpers, and
<code>flag_value</code> and <code>default</code> keep their unset
sentinel at construction
(resolved lazily on read) so <code>is UNSET</code> reliably tells a
user-supplied value
from an auto-derived one. Runtime behavior is unchanged, but
{meth}<code>Parameter.to_info_dict</code> now resolves
<code>default=True</code> on a feature
switch to its <code>flag_value</code>, matching what the function
receives at call
time. {pr}<code>3641</code></li>
<li>{func}<code>get_binary_stream</code> and
{func}<code>get_text_stream</code> are deprecated and
will be removed in Click 9.0. {issue}<code>3481</code>
{pr}<code>3695</code></li>
<li>The following <code>click.utils</code> names were never
intentionally public and are
now private (<code>_</code>-prefixed). The old names remain available
with a
<code>DeprecationWarning</code> until Click 9.0: <code>LazyFile</code>,
<code>KeepOpenFile</code>,</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pallets/click/commit/8b19813f2bfca99f1018a587a8cf54fc959f2e5d "><code>8b19813</code></a>
Release version 8.5.0</li>
<li><a
href="https://github.com/pallets/click/commit/2c8cd3ac958a7eb316d67f2d316c27086c4c0369 "><code>2c8cd3a</code></a>
Add FAQ entry about <code>UnicodeEncodeError</code> on Windows (<a
href="https://redirect.github.com/pallets/click/issues/3778 ">#3778</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/131c86aadddfa5cb6dca8339c9d6294c4eacb8ac "><code>131c86a</code></a>
Add FAQ entry about <code>UnicodeEncodeError</code> on Windows</li>
<li><a
href="https://github.com/pallets/click/commit/e1fd5946ab26aaf372009eaff1acf947140b40fb "><code>e1fd594</code></a>
Add support of <code>pathlib.Path</code> to <code>edit</code> (<a
href="https://redirect.github.com/pallets/click/issues/3781 ">#3781</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/a1d87858abd77fa8e3ffc204670ccd75b96c4781 "><code>a1d8785</code></a>
Add support of <code>pathlib.Path</code> to <code>edit</code></li>
<li><a
href="https://github.com/pallets/click/commit/2103e157683c5e4cadc8ee1838df526a54bde9a4 "><code>2103e15</code></a>
Forward all user's parameters set in <code>PAGER</code> and improve flag
detection (<a
href="https://redirect.github.com/pallets/click/issues/3777 ">#3777</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/a6256bfb5971d5e58585fe7b6c656134e1ade5a4 "><code>a6256bf</code></a>
Forwards all user's parameters set in <code>PAGER</code></li>
<li><a
href="https://github.com/pallets/click/commit/61b69e967e525bd502f5bf42def4d551e761fe0e "><code>61b69e9</code></a>
Resolve the pager command once, in <code>_pager_contextmanager</code>
(<a
href="https://redirect.github.com/pallets/click/issues/3776 ">#3776</a>)</li>
<li><a
href="https://github.com/pallets/click/commit/9835b0f7612d1b1ea180a975fd6d24cf16791ba8 "><code>9835b0f</code></a>
Resolve the pager command once, in
<code>_pager_contextmanager</code></li>
<li><a
href="https://github.com/pallets/click/commit/f36d58bbd7f188178de2d4fe1d0292c510375ca7 "><code>f36d58b</code></a>
Refactor pager stream handling (<a
href="https://redirect.github.com/pallets/click/issues/3767 ">#3767</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pallets/click/compare/8.4.2...8.5.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langgraph-sdk` from 0.4.2 to 0.4.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-sdk's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-sdk==0.4.4</h2>
<p>Changes since sdk==0.4.3</p>
<ul>
<li>release(sdk-py): 0.4.4 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8738 ">#8738</a>)</li>
<li>Merge commit from fork</li>
<li>feat: route LangSmith traces from thread streams (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8723 ">#8723</a>)</li>
</ul>
<h2>langgraph-sdk==0.4.3</h2>
<p>Changes since sdk==0.4.2</p>
<ul>
<li>release(sdk-py): 0.4.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8657 ">#8657</a>)</li>
<li>feat(sdk-py): add decrypt replacement result (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8598 ">#8598</a>)</li>
<li>release(langgraph): 1.2.11 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8595 ">#8595</a>)</li>
<li>chore(deps): bump the minor-and-patch group across 1 directory with
5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8532 ">#8532</a>)</li>
<li>release(checkpoint): 4.2.0 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8563 ">#8563</a>)</li>
<li>chore: enforce PLC0415 in tests for the remaining packages (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8547 ">#8547</a>)</li>
<li>release(langgraph): 1.2.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8462 ">#8462</a>)</li>
<li>chore(deps): bump websockets from 15.0.1 to 16.0 in /libs/sdk-py in
the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8253 ">#8253</a>)</li>
<li>fix(sdk-py): support clearing cron end_time via
update(end_time=None) (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8334 ">#8334</a>)</li>
<li>release(langgraph): 1.2.9 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8316 ">#8316</a>)</li>
<li>release(langgraph): 1.2.8 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8292 ">#8292</a>)</li>
<li>chore(deps): bump websockets from 15.0.1 to 16.0 in /libs/langgraph
in the major group (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8256 ">#8256</a>)</li>
<li>chore(deps): bump the minor-and-patch group in /libs/sdk-py with 9
updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8252 ">#8252</a>)</li>
<li>release(langgraph): 1.2.7 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8223 ">#8223</a>)</li>
<li>chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 in /libs/sdk-py
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8104 ">#8104</a>)</li>
<li>chore(deps): bump langsmith from 0.8.0 to 0.8.18 in /libs/sdk-py (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8174 ">#8174</a>)</li>
<li>release(langgraph): 1.2.6 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8139 ">#8139</a>)</li>
<li>docs: standardize package <code>README.md</code> structure (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8064 ">#8064</a>)</li>
<li>release(langgraph): 1.2.5 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8062 ">#8062</a>)</li>
<li>fix(langgraph): merge <code>lc_versions</code> config metadata (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8052 ">#8052</a>)</li>
<li>chore(deps-dev): bump starlette from 1.0.0 to 1.0.1 in /libs/sdk-py
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8006 ">#8006</a>)</li>
<li>chore: migrate Python type checking to ty (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8002 ">#8002</a>)</li>
<li>release(langgraph): 1.2.4 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7991 ">#7991</a>)</li>
<li>test(sdk-py): add factory-graph integration test exercising the
server factory path (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7978 ">#7978</a>)</li>
<li>release(langgraph): 1.2.3 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7945 ">#7945</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/a64414c87c8db294fd3b1c5581f39f5b491ef07e "><code>a64414c</code></a>
langgraph: release 0.4.4 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/4704 ">#4704</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/3a1c02ff3364fa68d6659282dc994e5c57fd1833 "><code>3a1c02f</code></a>
update for consistency</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/5ab2aa79bb4949ec96d593ffdd3f7fe6d1c7cc32 "><code>5ab2aa7</code></a>
lint again</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/c33e64daa6295be3fadd5c8664185fc4268b9f71 "><code>c33e64d</code></a>
use list</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/4ffae6065f1c7fe4dc00fed21ee9a584cbbb14b3 "><code>4ffae60</code></a>
lint + update</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/54ddde9d4c73a31cb921420867231542ae7faa72 "><code>54ddde9</code></a>
update</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/60c41ce69e17fff2367eb816a667dd38cf7bb58e "><code>60c41ce</code></a>
update</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/efd33d860fdef71bc37f286aeab71fae30a0e607 "><code>efd33d8</code></a>
update</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/254a38560e0f036531ac2cde7f55ce93a2cc3ff0 "><code>254a385</code></a>
langgraph: fix drawing graph with <strong>root</strong> channel</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b20130d4e4f50b95d3a97e648d461956d4a35445 "><code>b20130d</code></a>
langgraph: fix graph drawing for self-loops</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/0.4.2...0.4.4 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `python-dotenv` from 1.2.2 to 1.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/theskumar/python-dotenv/releases ">python-dotenv's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.3</h2>
<h3>Fixed</h3>
<ul>
<li>Strip a leading UTF-8 BOM from <code>.env</code> file contents so
the first variable is no longer silently lost when the file is saved
with BOM (e.g. by some JetBrains IDEs on Windows) by [<a
href="https://github.com/h1whelan "><code>@h1whelan</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/640 ">#640</a></li>
<li><code>set_key</code> now escapes backslashes, so values containing
them (Windows paths, regular expressions) survive a write/read
round-trip. Quoted values ending in an escaped backslash are no longer
mis-parsed as an escaped quote, which used to swallow the following
lines by [<a
href="https://github.com/dchaudhari7177 "><code>@dchaudhari7177</code></a>]
in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/680 ">#680</a></li>
<li><code>dotenv run</code> now prints a friendly error instead of a
traceback when no command is given by [<a
href="https://github.com/bbc2 "><code>@bbc2</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/606 ">#606</a></li>
<li>Cache the parsed result for empty <code>.env</code> files so
repeated <code>dotenv_values</code>/<code>load_dotenv</code> calls no
longer re-read the file by [<a
href="https://github.com/ReinerBRO "><code>@ReinerBRO</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/638 ">#638</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md ">python-dotenv's
changelog</a>.</em></p>
<blockquote>
<h2>[1.2.3] - 2026-08-16</h2>
<h3>Fixed</h3>
<ul>
<li>Strip a leading UTF-8 BOM from <code>.env</code> file contents so
the first variable is no longer silently lost when the file is saved
with BOM (e.g. by some JetBrains IDEs on Windows) by [<a
href="https://github.com/h1whelan "><code>@h1whelan</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/640 ">#640</a></li>
<li><code>set_key</code> now escapes backslashes, so values containing
them (Windows paths, regular expressions) survive a write/read
round-trip. Quoted values ending in an escaped backslash are no longer
mis-parsed as an escaped quote, which used to swallow the following
lines by [<a
href="https://github.com/dchaudhari7177 "><code>@dchaudhari7177</code></a>]
in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/680 ">#680</a></li>
<li><code>dotenv run</code> now prints a friendly error instead of a
traceback when no command is given by [<a
href="https://github.com/bbc2 "><code>@bbc2</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/606 ">#606</a></li>
<li>Cache the parsed result for empty <code>.env</code> files so
repeated <code>dotenv_values</code>/<code>load_dotenv</code> calls no
longer re-read the file by [<a
href="https://github.com/ReinerBRO "><code>@ReinerBRO</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/638 ">#638</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/49515afee2d50c33cad9419b3800b3a0dc93fc59 "><code>49515af</code></a>
Bump version: 1.2.2 → 1.2.3</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/8ac846ff2760b65470e769d7eed33e540f0934e1 "><code>8ac846f</code></a>
chore: add release runbook (RELEASING.md) and make release target</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/bb31c944fb4b40e8dea59587f525840c38326166 "><code>bb31c94</code></a>
docs: add 1.2.3 release notes (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/606 ">#606</a>,
<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/638 ">#638</a>,
<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/680 ">#680</a>)</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/f7b18d9c72d1abcc2ad4023424b84f5bee30d266 "><code>f7b18d9</code></a>
fix: round-trip backslashes through set_key (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/680 ">#680</a>)</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/751f8c148222e58aa173c83c4e5e6cfccb2cc124 "><code>751f8c1</code></a>
ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the
github-actions gro...</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/f1937b68f338d7ebd7754da377ca08b2f0df8dbb "><code>f1937b6</code></a>
chore(deps): update mkdocs-include-markdown-plugin requirement from
>=6.0.0 t...</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/45b93720dd5e9e127d0be3971a04855d34e464d8 "><code>45b9372</code></a>
chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/653 ">#653</a>)</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/72896e9244d2a1ff8d5e1934d3df8a35c813799a "><code>72896e9</code></a>
docs: fix broken mkdocs link in CONTRIBUTING.md (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/636 ">#636</a>)</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/72754a16a4743e4c92edf87ce59ba0e4ff78758d "><code>72754a1</code></a>
ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the
github-a...</li>
<li><a
href="https://github.com/theskumar/python-dotenv/commit/078325e92558330e9addc661b789c7b6123fa73c "><code>078325e</code></a>
ci(security): harden CI/CD supply chain with SHA pinning and
least-privilege ...</li>
<li>Additional commits viewable in <a
href="https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `hatch` from 1.17.1 to 1.18.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/hatch/releases ">hatch's
releases</a>.</em></p>
<blockquote>
<h2>Hatchling v1.18.0</h2>
<p><em><strong>Changed:</strong></em></p>
<ul>
<li>Drop support for Python 3.7</li>
</ul>
<p><em><strong>Added:</strong></em></p>
<ul>
<li>Update the list of directories that are always excluded for
builds</li>
</ul>
<h2>Hatch v1.18.0</h2>
<p><em><strong>Changed:</strong></em></p>
<ul>
<li>Upgrade default CPython distributions to 20260807</li>
</ul>
<p><em><strong>Added:</strong></em></p>
<ul>
<li>
<p>Add the <code>sources</code> environment option, which redirects
dependencies to a local path, Git repository, URL, alternate index, or
workspace member at install time without altering published metadata.
The top-level <code>[tool.hatch.sources]</code> table is an alias for
the <code>default</code> environment, environments inherit sources entry
by entry, the <code>HATCH_NO_SOURCES</code> environment variable
disables them, and <code>hatch dep show sources</code> reports what each
source redirects</p>
</li>
<li>
<p>Add the <code>--all</code>/<code>-a</code> flag to the
<code>build</code> command to build the workspace root and every
workspace member defined by the selected environment, consolidating
artifacts in the workspace root's <code>dist</code> directory by
default. A root that does not define a <code>project</code> table is
skipped so that a top-level <code>pyproject.toml</code> may only contain
workspace configuration</p>
</li>
<li>
<p>Add the <code>tool.hatch.requires-hatch</code> field, a version
specifier set that commands reading the project's metadata enforce
against the running version of Hatch</p>
</li>
<li>
<p>Add first-class support for free-threaded distribution names such as
<code>3.13t</code> and <code>3.14t</code> to the <code>python</code>
commands and environment <code>python</code> option, rather than
requiring the <code>HATCH_PYTHON_VARIANT_GIL</code> environment
variable</p>
</li>
<li>
<p>The <code>version</code> command can now bump versions that are
statically defined by the <code>project.version</code> field, updating
<code>pyproject.toml</code> in place. Pass <code>--force</code> to allow
an explicit downgrade</p>
</li>
<li>
<p>Support managing Python 3.15 distributions, currently 3.15.0rc1</p>
</li>
</ul>
<p><em><strong>Fixed:</strong></em></p>
<ul>
<li>
<p>Erase stale coverage data before running <code>hatch test
--cover</code>.</p>
</li>
<li>
<p>Fix environment creation crashing when a metadata hook exists that
doesn’t happen to be installed in the <code>hatch</code> CLI’s
environment.</p>
</li>
<li>
<p>Fix commands run by <code>hatch run</code> no longer being
interruptible with Ctrl-C, which happened because the ignored
<code>SIGINT</code> of the parent process was inherited by the child
process.</p>
</li>
<li>
<p>Fix the generated Pyrefly config being invalid on Windows, since
backslashes in the absolute paths were interpreted as TOML escape
sequences.</p>
</li>
<li>
<p>Fix the hardcoded reliance on <code>pip</code> when installing
dependencies internally by using <code>uv</code> instead.</p>
</li>
<li>
<p>Fix environment creation silently installing a GIL-enabled Python
distribution when Hatch itself runs on a free-threaded build. The
distribution matching the running interpreter, such as
<code>3.14t</code>, is now selected.</p>
</li>
<li>
<p>Fix free-threaded selectors such as <code>3.14t</code> being rejected
by an environment's <code>python</code> option, even though <code>hatch
python install 3.14t</code> already accepted them.</p>
</li>
<li>
<p>Never automatically select a prerelease Python distribution, such as
3.15.0rc1, when falling back to the latest compatible version. A
prerelease is still installed when requested explicitly.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/hatch/commit/558061c5ecbe7e9b10d81965d4cdc8df05832228 "><code>558061c</code></a>
Fix ci (<a
href="https://redirect.github.com/pypa/hatch/issues/2377 ">#2377</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/bc6d1bc1347445dfad06e731d4ae50f562692683 "><code>bc6d1bc</code></a>
release Hatch v1.18.0 (<a
href="https://redirect.github.com/pypa/hatch/issues/2376 ">#2376</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/8429e5d5bc84b2c9ace623b99518661e9032d422 "><code>8429e5d</code></a>
release Hatchling v1.32.0 (<a
href="https://redirect.github.com/pypa/hatch/issues/2375 ">#2375</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/413b3a880cfa69cb5095a927a725b074be669930 "><code>413b3a8</code></a>
Prepare for release (<a
href="https://redirect.github.com/pypa/hatch/issues/2374 ">#2374</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/4ccc9ea9cd2800c90549768f7eaa7dc9985b45e1 "><code>4ccc9ea</code></a>
Bug Fix - fix CTRL-C behavior to correctly handle signals (<a
href="https://redirect.github.com/pypa/hatch/issues/2369 ">#2369</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/a8858032b372ad8e13950a06b1783e723ee892e5 "><code>a885803</code></a>
Add sources to enable other types of local dependencies (<a
href="https://redirect.github.com/pypa/hatch/issues/2313 ">#2313</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/ab3e000585fc95c32196d406d0c224fca62ff1b1 "><code>ab3e000</code></a>
Add --all flag to hatch build for building all workspace members (<a
href="https://redirect.github.com/pypa/hatch/issues/2352 ">#2352</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/bb9027761d1325a540ca1eda5aee067098249b41 "><code>bb90277</code></a>
fix: Allow the <code>; private</code> annotation in
<code>import-names</code>/<code>import-namespaces</code> p...</li>
<li><a
href="https://github.com/pypa/hatch/commit/3a9d853a68d009db91e70e4271b1d688e5381d3b "><code>3a9d853</code></a>
fix: prevent backward relative paths in readme (<a
href="https://redirect.github.com/pypa/hatch/issues/2354 ">#2354</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/c4dc4f8ab4399a9f35b56c3367ff39d6fb09271c "><code>c4dc4f8</code></a>
test: Fix test expectations for metadata generated by
<code>flit-core</code> (<a
href="https://redirect.github.com/pypa/hatch/issues/2365 ">#2365</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/hatch/compare/hatch-v1.17.1...hatch-v1.18.0 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:12:26 -07:00
dependabot[bot]
bd1f031ac0
chore(deps): bump websockets from 16.0 to 16.1.1 in /libs/sdk-py in the major group ( #8781 )
...
Bumps the major group in /libs/sdk-py with 1 update:
[websockets](https://github.com/python-websockets/websockets ).
Updates `websockets` from 16.0 to 16.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python-websockets/websockets/releases ">websockets's
releases</a>.</em></p>
<blockquote>
<h2>16.1.1</h2>
<p>See <a
href="https://websockets.readthedocs.io/en/stable/project/changelog.html ">https://websockets.readthedocs.io/en/stable/project/changelog.html </a>
for details.</p>
<h2>16.1</h2>
<p>See <a
href="https://websockets.readthedocs.io/en/stable/project/changelog.html ">https://websockets.readthedocs.io/en/stable/project/changelog.html </a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python-websockets/websockets/commit/01df1e4e4d482cc70dfcd4a13c7bac1e956d4b9a "><code>01df1e4</code></a>
Revert "Decode non-ASCII header values with iso-8859-1."</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/2d61f74dcca4425b1d8563523e04d4ffaca24bbc "><code>2d61f74</code></a>
Clarify restriction on headers in 16.1.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/4df6f90d0724640275157a0fa784c234d309af82 "><code>4df6f90</code></a>
Release version 16.1.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/7c69ecac884abd8d70a9bcc22ef0bf0b950101d1 "><code>7c69eca</code></a>
Increase timeout for building wheels.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/493864e58462138345675d9875e096c40072dd11 "><code>493864e</code></a>
Complete and review changelog.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/73ff538bd7df88a08e982cd64a2ccbdfee74de6d "><code>73ff538</code></a>
Temporarily remove the trio implementation (again).</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/77f7d71870544e09e35795a8a6f48005abcb2a4b "><code>77f7d71</code></a>
Shorten changelog and docstring for previous commit.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/84859e19dd2ab3d0d482cd251518872dd604a302 "><code>84859e1</code></a>
Add text argument to broadcast() to force the frame type</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/1a38f5a55b82b2883cd4e0ee09c57491e85c969c "><code>1a38f5a</code></a>
Document research on removing a workaround.</li>
<li><a
href="https://github.com/python-websockets/websockets/commit/99431eea503c70b57412fbeda43481d3081d6037 "><code>99431ee</code></a>
Apply code style to docs/conf.py.</li>
<li>Additional commits viewable in <a
href="https://github.com/python-websockets/websockets/compare/16.0...16.1.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:12:20 -07:00
dependabot[bot]
d80317dd6c
chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example with 6 updates ( #8776 )
...
Bumps the minor-and-patch group in /libs/cli/js-monorepo-example with 6
updates:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo ) | `2.10.8` | `2.10.12` |
| [eslint](https://github.com/eslint/eslint ) | `10.8.0` | `10.9.1` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.65.0` | `8.68.0` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.65.0` | `8.68.0` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.4` | `1.2.9` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.8` | `1.4.13` |
Updates `turbo` from 2.10.8 to 2.10.12
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases ">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.12</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.10.11 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13765 ">vercel/turborepo#13765</a></li>
<li>feat: Refresh documentation social cards by <a
href="https://github.com/christopherkindl "><code>@christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13764 ">vercel/turborepo#13764</a></li>
<li>fix: Preserve showcase logo sizes by <a
href="https://github.com/christopherkindl "><code>@christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13766 ">vercel/turborepo#13766</a></li>
<li>fix: Refine mobile homepage interactions by <a
href="https://github.com/christopherkindl "><code>@christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13767 ">vercel/turborepo#13767</a></li>
<li>fix: Align homepage KPIs to the right by <a
href="https://github.com/christopherkindl "><code>@christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13769 ">vercel/turborepo#13769</a></li>
<li>fix: Prevent homepage KPI overflow by <a
href="https://github.com/christopherkindl "><code>@christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13770 ">vercel/turborepo#13770</a></li>
<li>chore: Update Geistdocs to 1.20.4 by <a
href="https://github.com/molebox "><code>@molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13771 ">vercel/turborepo#13771</a></li>
<li>perf: Skip unused Package Configuration <code>stat</code>s by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13746 ">vercel/turborepo#13746</a></li>
<li>chore: Update with-solid example by <a
href="https://github.com/vercel-gh-bot-5 "><code>@vercel-gh-bot-5</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13752 ">vercel/turborepo#13752</a></li>
<li>chore: Update with-tailwind example by <a
href="https://github.com/vercel-gh-bot-5 "><code>@vercel-gh-bot-5</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13762 ">vercel/turborepo#13762</a></li>
<li>perf: Stream dry-run JSON output by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13760 ">vercel/turborepo#13760</a></li>
<li>chore: Update with-ultracite example by <a
href="https://github.com/vercel-gh-bot-5 "><code>@vercel-gh-bot-5</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13772 ">vercel/turborepo#13772</a></li>
<li>perf: Merge same-prefix tree-wildcard globs into one directory walk
by <a
href="https://github.com/vercel-gh-bot-5 "><code>@vercel-gh-bot-5</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13763 ">vercel/turborepo#13763</a></li>
<li>chore: Update with-svelte example by <a
href="https://github.com/floriansalihovic "><code>@floriansalihovic</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13118 ">vercel/turborepo#13118</a></li>
<li>chore: Add unified agent control plane by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13757 ">vercel/turborepo#13757</a></li>
<li>fix: Remove incremental task caching by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13773 ">vercel/turborepo#13773</a></li>
<li>chore: Rename agents app to factory by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13774 ">vercel/turborepo#13774</a></li>
<li>chore: Update oxlint and oxfmt by <a
href="https://github.com/charpeni "><code>@charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13777 ">vercel/turborepo#13777</a></li>
<li>feat: Add security.txt endpoint by <a
href="https://github.com/charpeni "><code>@charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13778 ">vercel/turborepo#13778</a></li>
<li>feat: Redesign factory control plane by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13775 ">vercel/turborepo#13775</a></li>
<li>perf: Replace regex captures with hand-written parsers in berry
lockfile identifiers by <a
href="https://github.com/vercel-gh-bot-2 "><code>@vercel-gh-bot-2</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13776 ">vercel/turborepo#13776</a></li>
<li>chore: Upgrade the factory eve agent to 0.39.3 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13783 ">vercel/turborepo#13783</a></li>
<li>chore: Update with-rsbuild-module-federation example by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13786 ">vercel/turborepo#13786</a></li>
<li>perf: Index Berry lockfile resolution overrides by dependency name
by <a
href="https://github.com/vercel-gh-bot-5 "><code>@vercel-gh-bot-5</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13787 ">vercel/turborepo#13787</a></li>
<li>chore: Update remote cache action to v1.1.0 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13789 ">vercel/turborepo#13789</a></li>
<li>docs: Fix reference links and validation by <a
href="https://github.com/charpeni "><code>@charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13784 ">vercel/turborepo#13784</a></li>
<li>feat: Add SSH command affordance for factory sandboxes by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13779 ">vercel/turborepo#13779</a></li>
<li>fix: Show invalid affected task glob by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13793 ">vercel/turborepo#13793</a></li>
<li>perf: Skip unused repository indexing for package listings by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13792 ">vercel/turborepo#13792</a></li>
<li>feat: Rebuild the factory image on every merge to main by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13781 ">vercel/turborepo#13781</a></li>
<li>chore: Add full-page terminal SSH sessions to Factory sandbox
inventory by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13780 ">vercel/turborepo#13780</a></li>
<li>chore: Update with-shell-commands example by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13791 ">vercel/turborepo#13791</a></li>
<li>chore: Allow SSH terminal for completed-run sandboxes in Factory by
<a href="https://github.com/anthonyshew "><code>@anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13782 ">vercel/turborepo#13782</a></li>
<li>fix: Decouple graceful shutdown tests from the shell commands
example by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13799 ">vercel/turborepo#13799</a></li>
<li>feat: Start ad-hoc factory work from the operator page by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13798 ">vercel/turborepo#13798</a></li>
<li>chore: Update with-solid example by <a
href="https://github.com/vercel-gh-bot-4 "><code>@vercel-gh-bot-4</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13797 ">vercel/turborepo#13797</a></li>
<li>fix: Rebuild factory images without custom workflows by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13801 ">vercel/turborepo#13801</a></li>
<li>feat: Add factory navigation by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13802 ">vercel/turborepo#13802</a></li>
<li>refactor: Migrate Factory styles to Tailwind by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13803 ">vercel/turborepo#13803</a></li>
<li>feat: Add durable Factory workspaces by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13804 ">vercel/turborepo#13804</a></li>
<li>feat: Stream Factory sandbox as terminal by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13807 ">vercel/turborepo#13807</a></li>
<li>fix: Restore Factory workspace creation by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13812 ">vercel/turborepo#13812</a></li>
<li>fix: Update Factory session network policy by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13814 ">vercel/turborepo#13814</a></li>
<li>fix: Improve Factory terminal line spacing by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13815 ">vercel/turborepo#13815</a></li>
<li>fix: Install Factory publishing skill by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13817 ">vercel/turborepo#13817</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/53752d452049bdda47698354b16a83d7ce92ced0 "><code>53752d4</code></a>
publish 2.10.12 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/9d2b03bc946008c4dc528b51d6c080139cde859b "><code>9d2b03b</code></a>
fix: Run pnpm directly on Windows (<a
href="https://redirect.github.com/vercel/turborepo/issues/13843 ">#13843</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c97782bc4ef43697e0ee8c4fc7ad3cee81a0e1cf "><code>c97782b</code></a>
feat: Require high confidence for issue fixes (<a
href="https://redirect.github.com/vercel/turborepo/issues/13842 ">#13842</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/f153cda4cee5b9cce11108283b9911253687bc53 "><code>f153cda</code></a>
chore: Alert Slack for low-confidence issues (<a
href="https://redirect.github.com/vercel/turborepo/issues/13841 ">#13841</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/e1674e42513a1fffcf7e3a8a13e7f8bdd2f6043f "><code>e1674e4</code></a>
chore: Add automatic issue handling (<a
href="https://redirect.github.com/vercel/turborepo/issues/13840 ">#13840</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/7107f266c69f097abc888372c1bddacf647e0bce "><code>7107f26</code></a>
fix: Escape ampersands in RSS feed enclosure URLs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13839 ">#13839</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a76330b6ec70c64dbc3c2ad8fef7fe8a732fe0cd "><code>a76330b</code></a>
chore: Handle feedback on Factory pull requests (<a
href="https://redirect.github.com/vercel/turborepo/issues/13836 ">#13836</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3787c061d3d22d5c5134bf89c5704b97c3bffb24 "><code>3787c06</code></a>
chore: Use geistdocs 1.23.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13834 ">#13834</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/bbe5406a1a7704cee63daf2af8ae98479c56fbad "><code>bbe5406</code></a>
chore: Skip redundant Factory PR approval (<a
href="https://redirect.github.com/vercel/turborepo/issues/13837 ">#13837</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/72805d7508ee3661826d452cead2458dec8ff345 "><code>72805d7</code></a>
fix: Move model selector to workspace creation (<a
href="https://redirect.github.com/vercel/turborepo/issues/13835 ">#13835</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.12 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.8.0 to 10.9.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.9.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3 "><code>1e641c9</code></a>
fix: no-loss-of-precision false positive with trailing decimal point (<a
href="https://redirect.github.com/eslint/eslint/issues/21251 ">#21251</a>)
(Aleksandr Shoronov)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b "><code>ad74a8d</code></a>
docs: add deprecation steps for EOL package versions (<a
href="https://redirect.github.com/eslint/eslint/issues/21248 ">#21248</a>)
(Francesco Trotta)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52 "><code>3c3ae53</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21249 ">#21249</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.9.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/08de88e50294c4e01f6cae97eceeb578da55792b "><code>08de88e</code></a>
feat: handle underflow in no-loss-of-precision (<a
href="https://redirect.github.com/eslint/eslint/issues/21218 ">#21218</a>)
(Rithish S)</li>
<li><a
href="https://github.com/eslint/eslint/commit/55db4791120ae591d88089c43127b7b0e16866d4 "><code>55db479</code></a>
feat: add checkConditionalExpressions to
<code>no-unmodified-loop-condition</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21175 ">#21175</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2ba302554e7a24e9909bbdd026fd0c2d1d0d8638 "><code>2ba3025</code></a>
fix: prevent unsafe <code>no-var</code> autofix with hoisted functions
(<a
href="https://redirect.github.com/eslint/eslint/issues/21213 ">#21213</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8e6962219a605c5f5add10953aa31027da839194 "><code>8e69622</code></a>
fix: Prevent no-var autofix when var is shadowed by catch parameter (<a
href="https://redirect.github.com/eslint/eslint/issues/21204 ">#21204</a>)
(Yang Hyeonjong)</li>
<li><a
href="https://github.com/eslint/eslint/commit/684b57972e1ddf25e076fb36189c60bbcacee635 "><code>684b579</code></a>
fix: prefer-template invalid autofix creates a tagged template call (<a
href="https://redirect.github.com/eslint/eslint/issues/21207 ">#21207</a>)
(김채영)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9ef407a3b051e74f50dc7fb8914e2bd89b3e5e53 "><code>9ef407a</code></a>
docs: use eslint.config.* wherever config file names are listed (<a
href="https://redirect.github.com/eslint/eslint/issues/21216 ">#21216</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/87f66f4435c4df7f4f6815c939d153196ec03e3c "><code>87f66f4</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/585ef37516c0dc29ddb91ce2a2cdcc46fdbbd610 "><code>585ef37</code></a>
docs: update architecture documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21112 ">#21112</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f3993b0547bace7370e9728ee7408af49d367d76 "><code>f3993b0</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ffc87d6234b2aa4335eec069e5c4d6ac04832b9e "><code>ffc87d6</code></a>
docs: fix broken links in Further Reading sections (<a
href="https://redirect.github.com/eslint/eslint/issues/21203 ">#21203</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1a761e1d11b011fcb6bee181231a51010c500e4d "><code>1a761e1</code></a>
docs: update moved JSX specification links (<a
href="https://redirect.github.com/eslint/eslint/issues/21198 ">#21198</a>)
(Imran Mustafa)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4d00ca4064ae0d1a75b604a16c68ab9f386ad388 "><code>4d00ca4</code></a>
docs: update ESLint peer dependency to <code>^10.0.0</code> in shareable
configs (<a
href="https://redirect.github.com/eslint/eslint/issues/21202 ">#21202</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/510d1a2e87bc197219f42e195ddb638d2b183a5a "><code>510d1a2</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/899dbf131ce12a194b394bb8d67307df23509d17 "><code>899dbf1</code></a>
chore: update github/codeql-action action to v4.37.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21243 ">#21243</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/9aa38732177935bd1d7f1493732c0b67666be28a "><code>9aa3873</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21235 ">#21235</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dc1e7a8416937edefe04cf836ee202a6fc03bedd "><code>dc1e7a8</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21208 ">#21208</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f878d212e9622da9513bcd60d2aedb2e8bb4fc8b "><code>f878d21</code></a>
ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a
href="https://redirect.github.com/eslint/eslint/issues/21200 ">#21200</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/4891e50aceadb0e886ad7d8ab5ae2beab563de85 "><code>4891e50</code></a>
ci: bump github/codeql-action from 4.37.4 to 4.37.6 (<a
href="https://redirect.github.com/eslint/eslint/issues/21199 ">#21199</a>)
(dependabot[bot])</li>
</ul>
<h2>v10.8.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/18eb0a7e787b9fac3049ef3dad0e845d2bd940a4 "><code>18eb0a7</code></a>
fix: prevent ASI hazard in <code>no-unused-labels</code> autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21173 ">#21173</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/151ba3f5834a0909e8b9b1736f4889ac694c0104 "><code>151ba3f</code></a>
fix: false positives in <code>getter-return</code> and
<code>accessor-pairs</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21163 ">#21163</a>)
(Grit)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6898df9364639ee64b9448a4cb6b08a30c16bd37 "><code>6898df9</code></a>
fix: ignore meta-property names in <code>id-denylist</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21166 ">#21166</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4d7db6628e2badf0857cb88734fe641c3874bce9 "><code>4d7db66</code></a>
fix: ignore meta-property names in <code>id-match</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21167 ">#21167</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/677214e7eea83d8bc6e4b79eea871577e1369d5f "><code>677214e</code></a>
fix: handle ASI hazards in no-unused-vars removeVar suggestion (<a
href="https://redirect.github.com/eslint/eslint/issues/20935 ">#20935</a>)
(kuldeep kumar)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7d0cbf81cfdb7526b5c4cb7b222ddc7f257db560 "><code>7d0cbf8</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0a05812adb12598b32e85297b98df5ad14501d60 "><code>0a05812</code></a>
docs: add missing backticks to <code>no-duplicate-imports.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21183 ">#21183</a>)
(Lee Daeun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/678c90b55da2889d4400cbf6e2584ab683faf202 "><code>678c90b</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8a104242e8e1c5614940fab7324346974cff7d26 "><code>8a10424</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/5c8c2417b9ff462f2dc4e54a062c59135b45b845 "><code>5c8c241</code></a>
10.9.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/a7f3b7ddca7de8464995707d1bbac3ca91090015 "><code>a7f3b7d</code></a>
Build: changelog update for 10.9.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3 "><code>1e641c9</code></a>
fix: no-loss-of-precision false positive with trailing decimal point (<a
href="https://redirect.github.com/eslint/eslint/issues/21251 ">#21251</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b "><code>ad74a8d</code></a>
docs: add deprecation steps for EOL package versions (<a
href="https://redirect.github.com/eslint/eslint/issues/21248 ">#21248</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52 "><code>3c3ae53</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21249 ">#21249</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c27bc926e496985eb7911c09eb60914b2e4b5d0f "><code>c27bc92</code></a>
10.9.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/fa831d95b326e6d23671d9b2df1ea5dbc64f6f34 "><code>fa831d9</code></a>
Build: changelog update for 10.9.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/899dbf131ce12a194b394bb8d67307df23509d17 "><code>899dbf1</code></a>
chore: update github/codeql-action action to v4.37.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21243 ">#21243</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/08de88e50294c4e01f6cae97eceeb578da55792b "><code>08de88e</code></a>
feat: handle underflow in no-loss-of-precision (<a
href="https://redirect.github.com/eslint/eslint/issues/21218 ">#21218</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ef407a3b051e74f50dc7fb8914e2bd89b3e5e53 "><code>9ef407a</code></a>
docs: use eslint.config.* wherever config file names are listed (<a
href="https://redirect.github.com/eslint/eslint/issues/21216 ">#21216</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.8.0...v10.9.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.65.0 to 8.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.68.0</h2>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
<li><strong>utils:</strong> support ESLint rule meta.languages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12663 ">#12663</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>website:</strong> playground crashes on <code>extends</code>
configs (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12608 ">#12608</a>)</li>
<li><strong>website:</strong> account for thanks.dev and out-of-band
donors in sponsors list (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12735 ">#12735</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Thiago Barbosa</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.67.0</h2>
<h2>8.67.0 (2026-08-10)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>typescript-eslint:</strong> export basic globs for using
tseslint (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12105 ">#12105</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.66.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.67.0 (2026-08-10)</h2>
<p>This was a version bump only for eslint-plugin to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.66.0 (2026-08-03)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [class-literal-property-style]
preserve type annotations and don't drop decorators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617 ">#12617</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
check MappedType key remapping (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588 ">#12588</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
don't report defaults used by other overloads (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607 ">#12607</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle
shadowed Boolean calls (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591 ">#12591</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore shadowed built-ins (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590 ">#12590</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f4e00a4e8f3bdf93a5e5e8bc568ba1c15a4f896 "><code>8f4e00a</code></a>
chore(release): publish 8.68.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/db30514e0f912dad32417a8e165bb9cce6f6a9d0 "><code>db30514</code></a>
feat(eslint-plugin): [strict-void-return] add fix suggestions (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12086 ">#12086</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9690339c4e50e65121fdd7d1eb55c5831460cd88 "><code>9690339</code></a>
test(eslint-plugin): [prefer-optional-chain] use
<code>createRuleTesterWithTypes</code> ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/abe9011a43524ea867e249125250d0927065750e "><code>abe9011</code></a>
fix(eslint-plugin): [no-empty-object-type] ignore suggestions that
result in ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79c16e784056ed9d6fea92268f036c18f46530ff "><code>79c16e7</code></a>
chore(eslint-plugin): extract FunctionSignature and enum comparison
utils (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2442e3048ba5a120a5e7dff5450fb5c440c0fc15 "><code>2442e30</code></a>
test(eslint-plugin): [no-floating-promises] format test snippets (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12723 ">#12723</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3596323c63dc92b9a8858992b66afa65642a69ca "><code>3596323</code></a>
fix(eslint-plugin): [no-floating-promises] setting <code>ignoreVoid:
false</code> result...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/956a3397d9e1c4aacd55f70bf0210e15ba005508 "><code>956a339</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] prevent stack
overflow in...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/55f6d5d4ca39d2fab93db97ced497b956017878d "><code>55f6d5d</code></a>
chore: enable source maps (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12677 ">#12677</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3aefb6a27d4a7f4c5e30486cba31e6f567966aae "><code>3aefb6a</code></a>
test: improve vitest performance with <code>isolate: false</code> (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12703 ">#12703</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.65.0 to 8.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.68.0</h2>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
<li><strong>utils:</strong> support ESLint rule meta.languages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12663 ">#12663</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>website:</strong> playground crashes on <code>extends</code>
configs (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12608 ">#12608</a>)</li>
<li><strong>website:</strong> account for thanks.dev and out-of-band
donors in sponsors list (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12735 ">#12735</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Thiago Barbosa</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.67.0</h2>
<h2>8.67.0 (2026-08-10)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>typescript-eslint:</strong> export basic globs for using
tseslint (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12105 ">#12105</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.66.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.68.0 (2026-08-24)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.67.0 (2026-08-10)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.66.0 (2026-08-03)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f4e00a4e8f3bdf93a5e5e8bc568ba1c15a4f896 "><code>8f4e00a</code></a>
chore(release): publish 8.68.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/55f6d5d4ca39d2fab93db97ced497b956017878d "><code>55f6d5d</code></a>
chore: enable source maps (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12677 ">#12677</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/20a261fb8e62351e88176b075090dc9276d26072 "><code>20a261f</code></a>
chore(release): publish 8.67.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3b155bb1344fd7ce83086cf2f864a7e8f3b4a217 "><code>3b155bb</code></a>
chore: use typescript 7 for typechecking (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12601 ">#12601</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e51b11ba3ab31837762c675f62f0d4dcb1abc4fb "><code>e51b11b</code></a>
chore(release): publish 8.66.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.2.4 to 1.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.9</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11402 ">#11402</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62 "><code>43e4396</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- Fix ChatVertexAI/ChatGoogle content blocks: include
<code>tool_call</code> blocks from <code>message.tool_calls</code> and
skip spurious empty <code>text</code> blocks in
<code>contentBlocks</code>.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369 ">#11369</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1 "><code>d6ad973</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(langchain): use unified endpoint for gateway</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342 ">#11342</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41 "><code>3b0e4c4</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- feat(core): mark errors as retryable or not, and stop retrying the
ones that aren't</p>
<p>Retry middleware retried every failure up to <code>maxRetries</code>,
including deterministic ones like a bad API key or an unknown model.
Retries also nest, so a single such failure could cost dozens of API
calls.</p>
<p><code>@langchain/core/errors</code> adds <code>stampRetryable(error,
retryable)</code> and <code>getRetryable(error)</code>. Marking an error
leaves its class and shape untouched, so a provider SDK error can be
classified without breaking <code>instanceof</code>.
<code>getRetryable</code> returns <code>undefined</code> for errors
nobody classified, and both are exported so tool authors can mark their
own failures.</p>
<p><code>modelRetryMiddleware</code> and
<code>toolRetryMiddleware</code> now respect the mark by default, and
retries stop as soon as one is found rather than each layer spending its
own budget. Aborted calls, context overflow, and oversized payloads are
marked non-retryable out of the box.
Models accept a per-call <code>maxRetries</code> so a surrounding retry
loop can take over.</p>
<p><strong>Behavior change:</strong> errors marked non-retryable now
fail on the first attempt. Unclassified errors — including any from
third-party integrations or custom tools — retry exactly as before. Pass
<code>retryOn: () => true</code> to restore the old default. A custom
<code>onFailedAttempt</code> replaces the built-in handler and opts out
of marking.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366 ">#11366</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41 "><code>c068bbf</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(core,langchain): patch and release core, update peer
dependencies</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344 ">#11344</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107a5598a3a0 "><code>f08e0c6</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix: apply [Symbol.hasInstance] method to all comparable properties
using .isInstance()</p>
<p>We have some internal schemas that rely on
<code>z.instanceof()</code>. This uses a strict <code>instanceof</code>
check which can conflict if there are multiple versions of core
installed. This overrides the <a
href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/hasInstance ">Symbol.hasInstance</a>
method to use the same logic as <code>.isInstance()</code> to compare
objects at runtime.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305 ">#11305</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723 "><code>e654022</code></a>
Thanks <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a>! -
Add LangSmith Gateway environment configuration to OpenAI, Anthropic,
and Fireworks chat models.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11295 ">#11295</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/1a1b347d18bc68e842df8badffc987493c81d70a "><code>1a1b347</code></a>
Thanks <a
href="https://github.com/vladislav-nechakhin "><code>@vladislav-nechakhin</code></a>!
- fix(core): pass the mustache escape override per render call</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e493ed653d734e31a8d051f78ab29b067f530e4b "><code>e493ed6</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11393 ">#11393</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/83848481ea27502c4221a01b4c55a87f1fa7c472 "><code>8384848</code></a>
fix(google-common): release endpoint routing fix as patch (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11413 ">#11413</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8cfff4dced1327fc87893a86dfc63c553403aec0 "><code>8cfff4d</code></a>
feat(google): add gateway support for genai (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11405 ">#11405</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78 "><code>7df258c</code></a>
chore(langchain): update langgraph deps (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11412 ">#11412</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3ceef4baadfaec8f0b1e43191b9363cfcc04187f "><code>3ceef4b</code></a>
fix(anthropic): round-trip tool search server-tool result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11407 ">#11407</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641 "><code>fe8eec1</code></a>
fix(openai): drop Gemini functionCall content blocks in Chat Completions
mess...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0e7c7654c8bd84b80fe9a2495ab2703355ff8c1e "><code>0e7c765</code></a>
fix(google-genai): throw ContentBlockedError when Gemini candidate has
no con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027 "><code>5c9fdf2</code></a>
fix(openai): retain cache_write_tokens, update to v7 sdk (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11399 ">#11399</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5ff9179e25f594d7cd21e176fdadd953190375c5 "><code>5ff9179</code></a>
fix(google-genai): guard streaming chunks when candidate has no content
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10742 ">#10742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62 "><code>43e4396</code></a>
fix(core): include tool_call blocks and skip empty text blocks in
ChatVertexA...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.4...@langchain/core@1.2.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.8 to 1.4.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f8bdf16d4fe23a79e945ea5dc6f86bbf09abb77d "><code>f8bdf16</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/cef10ab35cefea12c36a8864cdf12f51c7553975 "><code>cef10ab</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.10.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714 ">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706 ">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain "><code>@zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: "messages"</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f "><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924 "><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5 "><code>a86f813</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.30</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690 ">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain "><code>@saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653 ">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311 "><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f8bdf16d4fe23a79e945ea5dc6f86bbf09abb77d "><code>f8bdf16</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/cef10ab35cefea12c36a8864cdf12f51c7553975 "><code>cef10ab</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.10.0</li>
</ul>
</li>
</ul>
<h2>1.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714 ">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2>1.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706 ">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain "><code>@zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: "messages"</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f "><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924 "><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5 "><code>a86f813</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.30</li>
</ul>
</li>
</ul>
<h2>1.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690 ">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain "><code>@saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
<h2>1.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653 ">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311 "><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3609b35036f18c5a0cf9746910a45e0ab65ccf97 "><code>3609b35</code></a>
docs: fix typo in cache policy comment (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2740 ">#2740</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3ed60cbd108501e719e93d42a1f5219b577a34a8 "><code>3ed60cb</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2728 ">#2728</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6530ba9b4c577c560422d9c9de18914e67411d9d "><code>6530ba9</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2715 ">#2715</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/c3b27a997c682a64f65904b2a97a5ee4d6e741b0 "><code>c3b27a9</code></a>
fix(checkpoint): narrow re-constructable types in JsonPlusSerializer (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2709 ">#2709</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/659d628d196f6b1ba7aa46b30293c31ff5715cf4 "><code>659d628</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2704 ">#2704</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
fix(langgraph): dedupe merged callback handlers by identity (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2706 ">#2706</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/f6b41bf4861322e380e02f746285496e84b0f96b "><code>f6b41bf</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2698 ">#2698</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
fix(langgraph): keep context values out of tracer-derived metadata (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2690 ">#2690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6ac60da74f6b9e29d20b111a7947ac3060f1d2dd "><code>6ac60da</code></a>
chore(deps): bump the langchain group across 1 directory with 5 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2651 ">#2651</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15 "><code>5f99152</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655 ">#2655</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.13/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:11:57 -07:00
dependabot[bot]
394c109737
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-sqlite with 2 updates ( #8772 )
...
Bumps the minor-and-patch group in /libs/checkpoint-sqlite with 2
updates: [ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:11:52 -07:00
dependabot[bot]
0c1a062f88
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 6 updates ( #8775 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.4` | `1.2.9` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.8` | `1.4.13` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.65.0` | `8.68.0` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.65.0` | `8.68.0` |
| [eslint](https://github.com/eslint/eslint ) | `10.8.0` | `10.9.1` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest ) |
`30.4.2` | `30.5.0` |
Updates `@langchain/core` from 1.2.4 to 1.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.9</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11402 ">#11402</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62 "><code>43e4396</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- Fix ChatVertexAI/ChatGoogle content blocks: include
<code>tool_call</code> blocks from <code>message.tool_calls</code> and
skip spurious empty <code>text</code> blocks in
<code>contentBlocks</code>.</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369 ">#11369</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1 "><code>d6ad973</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(langchain): use unified endpoint for gateway</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342 ">#11342</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41 "><code>3b0e4c4</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain "><code>@thushanth-bengre-langchain</code></a>!
- feat(core): mark errors as retryable or not, and stop retrying the
ones that aren't</p>
<p>Retry middleware retried every failure up to <code>maxRetries</code>,
including deterministic ones like a bad API key or an unknown model.
Retries also nest, so a single such failure could cost dozens of API
calls.</p>
<p><code>@langchain/core/errors</code> adds <code>stampRetryable(error,
retryable)</code> and <code>getRetryable(error)</code>. Marking an error
leaves its class and shape untouched, so a provider SDK error can be
classified without breaking <code>instanceof</code>.
<code>getRetryable</code> returns <code>undefined</code> for errors
nobody classified, and both are exported so tool authors can mark their
own failures.</p>
<p><code>modelRetryMiddleware</code> and
<code>toolRetryMiddleware</code> now respect the mark by default, and
retries stop as soon as one is found rather than each layer spending its
own budget. Aborted calls, context overflow, and oversized payloads are
marked non-retryable out of the box.
Models accept a per-call <code>maxRetries</code> so a surrounding retry
loop can take over.</p>
<p><strong>Behavior change:</strong> errors marked non-retryable now
fail on the first attempt. Unclassified errors — including any from
third-party integrations or custom tools — retry exactly as before. Pass
<code>retryOn: () => true</code> to restore the old default. A custom
<code>onFailedAttempt</code> replaces the built-in handler and opts out
of marking.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366 ">#11366</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41 "><code>c068bbf</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(core,langchain): patch and release core, update peer
dependencies</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344 ">#11344</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107a5598a3a0 "><code>f08e0c6</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix: apply [Symbol.hasInstance] method to all comparable properties
using .isInstance()</p>
<p>We have some internal schemas that rely on
<code>z.instanceof()</code>. This uses a strict <code>instanceof</code>
check which can conflict if there are multiple versions of core
installed. This overrides the <a
href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/hasInstance ">Symbol.hasInstance</a>
method to use the same logic as <code>.isInstance()</code> to compare
objects at runtime.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305 ">#11305</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723 "><code>e654022</code></a>
Thanks <a
href="https://github.com/jacoblee93 "><code>@jacoblee93</code></a>! -
Add LangSmith Gateway environment configuration to OpenAI, Anthropic,
and Fireworks chat models.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11295 ">#11295</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/1a1b347d18bc68e842df8badffc987493c81d70a "><code>1a1b347</code></a>
Thanks <a
href="https://github.com/vladislav-nechakhin "><code>@vladislav-nechakhin</code></a>!
- fix(core): pass the mustache escape override per render call</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e493ed653d734e31a8d051f78ab29b067f530e4b "><code>e493ed6</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11393 ">#11393</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/83848481ea27502c4221a01b4c55a87f1fa7c472 "><code>8384848</code></a>
fix(google-common): release endpoint routing fix as patch (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11413 ">#11413</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8cfff4dced1327fc87893a86dfc63c553403aec0 "><code>8cfff4d</code></a>
feat(google): add gateway support for genai (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11405 ">#11405</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78 "><code>7df258c</code></a>
chore(langchain): update langgraph deps (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11412 ">#11412</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3ceef4baadfaec8f0b1e43191b9363cfcc04187f "><code>3ceef4b</code></a>
fix(anthropic): round-trip tool search server-tool result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11407 ">#11407</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641 "><code>fe8eec1</code></a>
fix(openai): drop Gemini functionCall content blocks in Chat Completions
mess...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0e7c7654c8bd84b80fe9a2495ab2703355ff8c1e "><code>0e7c765</code></a>
fix(google-genai): throw ContentBlockedError when Gemini candidate has
no con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027 "><code>5c9fdf2</code></a>
fix(openai): retain cache_write_tokens, update to v7 sdk (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11399 ">#11399</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5ff9179e25f594d7cd21e176fdadd953190375c5 "><code>5ff9179</code></a>
fix(google-genai): guard streaming chunks when candidate has no content
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10742 ">#10742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62 "><code>43e4396</code></a>
fix(core): include tool_call blocks and skip empty text blocks in
ChatVertexA...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.4...@langchain/core@1.2.9 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.8 to 1.4.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f8bdf16d4fe23a79e945ea5dc6f86bbf09abb77d "><code>f8bdf16</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/cef10ab35cefea12c36a8864cdf12f51c7553975 "><code>cef10ab</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.10.0</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714 ">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706 ">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain "><code>@zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: "messages"</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f "><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924 "><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5 "><code>a86f813</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.30</li>
</ul>
</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690 ">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain "><code>@saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653 ">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311 "><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.13</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f8bdf16d4fe23a79e945ea5dc6f86bbf09abb77d "><code>f8bdf16</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/cef10ab35cefea12c36a8864cdf12f51c7553975 "><code>cef10ab</code></a>]:
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.10.0</li>
</ul>
</li>
</ul>
<h2>1.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714 ">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978 "><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-checkpoint</code><a
href="https://github.com/1 "><code>@1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2>1.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706 ">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain "><code>@zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: "messages"</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f "><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924 "><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5 "><code>a86f813</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.30</li>
</ul>
</li>
</ul>
<h2>1.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690 ">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain "><code>@saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
<h2>1.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653 ">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311 "><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3609b35036f18c5a0cf9746910a45e0ab65ccf97 "><code>3609b35</code></a>
docs: fix typo in cache policy comment (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2740 ">#2740</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3ed60cbd108501e719e93d42a1f5219b577a34a8 "><code>3ed60cb</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2728 ">#2728</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6530ba9b4c577c560422d9c9de18914e67411d9d "><code>6530ba9</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2715 ">#2715</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/c3b27a997c682a64f65904b2a97a5ee4d6e741b0 "><code>c3b27a9</code></a>
fix(checkpoint): narrow re-constructable types in JsonPlusSerializer (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2709 ">#2709</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/659d628d196f6b1ba7aa46b30293c31ff5715cf4 "><code>659d628</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2704 ">#2704</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd "><code>eaa5472</code></a>
fix(langgraph): dedupe merged callback handlers by identity (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2706 ">#2706</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/f6b41bf4861322e380e02f746285496e84b0f96b "><code>f6b41bf</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2698 ">#2698</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0 "><code>00f68a1</code></a>
fix(langgraph): keep context values out of tracer-derived metadata (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2690 ">#2690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6ac60da74f6b9e29d20b111a7947ac3060f1d2dd "><code>6ac60da</code></a>
chore(deps): bump the langchain group across 1 directory with 5 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2651 ">#2651</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15 "><code>5f99152</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655 ">#2655</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.13/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.65.0 to 8.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.68.0</h2>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
<li><strong>utils:</strong> support ESLint rule meta.languages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12663 ">#12663</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>website:</strong> playground crashes on <code>extends</code>
configs (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12608 ">#12608</a>)</li>
<li><strong>website:</strong> account for thanks.dev and out-of-band
donors in sponsors list (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12735 ">#12735</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Thiago Barbosa</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.67.0</h2>
<h2>8.67.0 (2026-08-10)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>typescript-eslint:</strong> export basic globs for using
tseslint (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12105 ">#12105</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.66.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.67.0 (2026-08-10)</h2>
<p>This was a version bump only for eslint-plugin to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.66.0 (2026-08-03)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [class-literal-property-style]
preserve type annotations and don't drop decorators (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617 ">#12617</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters]
check MappedType key remapping (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588 ">#12588</a>)</li>
<li><strong>eslint-plugin:</strong> [no-useless-default-assignment]
don't report defaults used by other overloads (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607 ">#12607</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle
shadowed Boolean calls (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591 ">#12591</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion]
ignore shadowed built-ins (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590 ">#12590</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0 ">GitHub
Releases</a> for more information.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f4e00a4e8f3bdf93a5e5e8bc568ba1c15a4f896 "><code>8f4e00a</code></a>
chore(release): publish 8.68.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/db30514e0f912dad32417a8e165bb9cce6f6a9d0 "><code>db30514</code></a>
feat(eslint-plugin): [strict-void-return] add fix suggestions (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12086 ">#12086</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9690339c4e50e65121fdd7d1eb55c5831460cd88 "><code>9690339</code></a>
test(eslint-plugin): [prefer-optional-chain] use
<code>createRuleTesterWithTypes</code> ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/abe9011a43524ea867e249125250d0927065750e "><code>abe9011</code></a>
fix(eslint-plugin): [no-empty-object-type] ignore suggestions that
result in ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/79c16e784056ed9d6fea92268f036c18f46530ff "><code>79c16e7</code></a>
chore(eslint-plugin): extract FunctionSignature and enum comparison
utils (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/2442e3048ba5a120a5e7dff5450fb5c440c0fc15 "><code>2442e30</code></a>
test(eslint-plugin): [no-floating-promises] format test snippets (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12723 ">#12723</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3596323c63dc92b9a8858992b66afa65642a69ca "><code>3596323</code></a>
fix(eslint-plugin): [no-floating-promises] setting <code>ignoreVoid:
false</code> result...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/956a3397d9e1c4aacd55f70bf0210e15ba005508 "><code>956a339</code></a>
fix(eslint-plugin): [no-unnecessary-type-assertion] prevent stack
overflow in...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/55f6d5d4ca39d2fab93db97ced497b956017878d "><code>55f6d5d</code></a>
chore: enable source maps (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12677 ">#12677</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3aefb6a27d4a7f4c5e30486cba31e6f567966aae "><code>3aefb6a</code></a>
test: improve vitest performance with <code>isolate: false</code> (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12703 ">#12703</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.65.0 to 8.68.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.68.0</h2>
<h2>8.68.0 (2026-08-24)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [strict-void-return] add fix
suggestions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12086 ">#12086</a>)</li>
<li><strong>utils:</strong> support ESLint rule meta.languages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12663 ">#12663</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [unified-signatures] deduplicate
types in report (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12656 ">#12656</a>)</li>
<li><strong>eslint-plugin:</strong> [return-await] prevent autofix from
breaking code in arrow-functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12707 ">#12707</a>)</li>
<li><strong>eslint-plugin:</strong> [unified-signatures] report
identical signatures (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12678 ">#12678</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
prevent stack overflow in recursive types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12711 ">#12711</a>)</li>
<li><strong>eslint-plugin:</strong> [no-floating-promises] setting
<code>ignoreVoid: false</code> results in false negative in
ArrowFunctionExpression (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12646 ">#12646</a>)</li>
<li><strong>eslint-plugin:</strong> [no-empty-object-type] ignore
suggestions that result in invalid interfaces and export defaults (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12739 ">#12739</a>)</li>
<li><strong>website:</strong> playground crashes on <code>extends</code>
configs (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12608 ">#12608</a>)</li>
<li><strong>website:</strong> account for thanks.dev and out-of-band
donors in sponsors list (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12735 ">#12735</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Hugo <a
href="https://github.com/hugop95 "><code>@hugop95</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Niki <a
href="https://github.com/phaux "><code>@phaux</code></a></li>
<li>Thiago Barbosa</li>
<li>Younsang Na <a
href="https://github.com/nayounsang "><code>@nayounsang</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.67.0</h2>
<h2>8.67.0 (2026-08-10)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>typescript-eslint:</strong> export basic globs for using
tseslint (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12105 ">#12105</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.66.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.68.0 (2026-08-24)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.67.0 (2026-08-10)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.66.0 (2026-08-03)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/8f4e00a4e8f3bdf93a5e5e8bc568ba1c15a4f896 "><code>8f4e00a</code></a>
chore(release): publish 8.68.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/55f6d5d4ca39d2fab93db97ced497b956017878d "><code>55f6d5d</code></a>
chore: enable source maps (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12677 ">#12677</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/20a261fb8e62351e88176b075090dc9276d26072 "><code>20a261f</code></a>
chore(release): publish 8.67.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/3b155bb1344fd7ce83086cf2f864a7e8f3b4a217 "><code>3b155bb</code></a>
chore: use typescript 7 for typechecking (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12601 ">#12601</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/e51b11ba3ab31837762c675f62f0d4dcb1abc4fb "><code>e51b11b</code></a>
chore(release): publish 8.66.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.8.0 to 10.9.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.9.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3 "><code>1e641c9</code></a>
fix: no-loss-of-precision false positive with trailing decimal point (<a
href="https://redirect.github.com/eslint/eslint/issues/21251 ">#21251</a>)
(Aleksandr Shoronov)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b "><code>ad74a8d</code></a>
docs: add deprecation steps for EOL package versions (<a
href="https://redirect.github.com/eslint/eslint/issues/21248 ">#21248</a>)
(Francesco Trotta)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52 "><code>3c3ae53</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21249 ">#21249</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.9.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/08de88e50294c4e01f6cae97eceeb578da55792b "><code>08de88e</code></a>
feat: handle underflow in no-loss-of-precision (<a
href="https://redirect.github.com/eslint/eslint/issues/21218 ">#21218</a>)
(Rithish S)</li>
<li><a
href="https://github.com/eslint/eslint/commit/55db4791120ae591d88089c43127b7b0e16866d4 "><code>55db479</code></a>
feat: add checkConditionalExpressions to
<code>no-unmodified-loop-condition</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21175 ">#21175</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2ba302554e7a24e9909bbdd026fd0c2d1d0d8638 "><code>2ba3025</code></a>
fix: prevent unsafe <code>no-var</code> autofix with hoisted functions
(<a
href="https://redirect.github.com/eslint/eslint/issues/21213 ">#21213</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8e6962219a605c5f5add10953aa31027da839194 "><code>8e69622</code></a>
fix: Prevent no-var autofix when var is shadowed by catch parameter (<a
href="https://redirect.github.com/eslint/eslint/issues/21204 ">#21204</a>)
(Yang Hyeonjong)</li>
<li><a
href="https://github.com/eslint/eslint/commit/684b57972e1ddf25e076fb36189c60bbcacee635 "><code>684b579</code></a>
fix: prefer-template invalid autofix creates a tagged template call (<a
href="https://redirect.github.com/eslint/eslint/issues/21207 ">#21207</a>)
(김채영)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9ef407a3b051e74f50dc7fb8914e2bd89b3e5e53 "><code>9ef407a</code></a>
docs: use eslint.config.* wherever config file names are listed (<a
href="https://redirect.github.com/eslint/eslint/issues/21216 ">#21216</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/87f66f4435c4df7f4f6815c939d153196ec03e3c "><code>87f66f4</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/585ef37516c0dc29ddb91ce2a2cdcc46fdbbd610 "><code>585ef37</code></a>
docs: update architecture documentation (<a
href="https://redirect.github.com/eslint/eslint/issues/21112 ">#21112</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f3993b0547bace7370e9728ee7408af49d367d76 "><code>f3993b0</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ffc87d6234b2aa4335eec069e5c4d6ac04832b9e "><code>ffc87d6</code></a>
docs: fix broken links in Further Reading sections (<a
href="https://redirect.github.com/eslint/eslint/issues/21203 ">#21203</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1a761e1d11b011fcb6bee181231a51010c500e4d "><code>1a761e1</code></a>
docs: update moved JSX specification links (<a
href="https://redirect.github.com/eslint/eslint/issues/21198 ">#21198</a>)
(Imran Mustafa)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4d00ca4064ae0d1a75b604a16c68ab9f386ad388 "><code>4d00ca4</code></a>
docs: update ESLint peer dependency to <code>^10.0.0</code> in shareable
configs (<a
href="https://redirect.github.com/eslint/eslint/issues/21202 ">#21202</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/510d1a2e87bc197219f42e195ddb638d2b183a5a "><code>510d1a2</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/899dbf131ce12a194b394bb8d67307df23509d17 "><code>899dbf1</code></a>
chore: update github/codeql-action action to v4.37.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21243 ">#21243</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/9aa38732177935bd1d7f1493732c0b67666be28a "><code>9aa3873</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21235 ">#21235</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dc1e7a8416937edefe04cf836ee202a6fc03bedd "><code>dc1e7a8</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21208 ">#21208</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f878d212e9622da9513bcd60d2aedb2e8bb4fc8b "><code>f878d21</code></a>
ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a
href="https://redirect.github.com/eslint/eslint/issues/21200 ">#21200</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/4891e50aceadb0e886ad7d8ab5ae2beab563de85 "><code>4891e50</code></a>
ci: bump github/codeql-action from 4.37.4 to 4.37.6 (<a
href="https://redirect.github.com/eslint/eslint/issues/21199 ">#21199</a>)
(dependabot[bot])</li>
</ul>
<h2>v10.8.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/18eb0a7e787b9fac3049ef3dad0e845d2bd940a4 "><code>18eb0a7</code></a>
fix: prevent ASI hazard in <code>no-unused-labels</code> autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21173 ">#21173</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/151ba3f5834a0909e8b9b1736f4889ac694c0104 "><code>151ba3f</code></a>
fix: false positives in <code>getter-return</code> and
<code>accessor-pairs</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21163 ">#21163</a>)
(Grit)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6898df9364639ee64b9448a4cb6b08a30c16bd37 "><code>6898df9</code></a>
fix: ignore meta-property names in <code>id-denylist</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21166 ">#21166</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4d7db6628e2badf0857cb88734fe641c3874bce9 "><code>4d7db66</code></a>
fix: ignore meta-property names in <code>id-match</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21167 ">#21167</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/677214e7eea83d8bc6e4b79eea871577e1369d5f "><code>677214e</code></a>
fix: handle ASI hazards in no-unused-vars removeVar suggestion (<a
href="https://redirect.github.com/eslint/eslint/issues/20935 ">#20935</a>)
(kuldeep kumar)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7d0cbf81cfdb7526b5c4cb7b222ddc7f257db560 "><code>7d0cbf8</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0a05812adb12598b32e85297b98df5ad14501d60 "><code>0a05812</code></a>
docs: add missing backticks to <code>no-duplicate-imports.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21183 ">#21183</a>)
(Lee Daeun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/678c90b55da2889d4400cbf6e2584ab683faf202 "><code>678c90b</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8a104242e8e1c5614940fab7324346974cff7d26 "><code>8a10424</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/5c8c2417b9ff462f2dc4e54a062c59135b45b845 "><code>5c8c241</code></a>
10.9.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/a7f3b7ddca7de8464995707d1bbac3ca91090015 "><code>a7f3b7d</code></a>
Build: changelog update for 10.9.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/1e641c919fc1421493bf913feb607896982451a3 "><code>1e641c9</code></a>
fix: no-loss-of-precision false positive with trailing decimal point (<a
href="https://redirect.github.com/eslint/eslint/issues/21251 ">#21251</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ad74a8dada2aaa17bfd0b8cc7b4119ff7a8ac04b "><code>ad74a8d</code></a>
docs: add deprecation steps for EOL package versions (<a
href="https://redirect.github.com/eslint/eslint/issues/21248 ">#21248</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3c3ae53a43721162f0db76c69665ebd9d752ea52 "><code>3c3ae53</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21249 ">#21249</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c27bc926e496985eb7911c09eb60914b2e4b5d0f "><code>c27bc92</code></a>
10.9.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/fa831d95b326e6d23671d9b2df1ea5dbc64f6f34 "><code>fa831d9</code></a>
Build: changelog update for 10.9.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/899dbf131ce12a194b394bb8d67307df23509d17 "><code>899dbf1</code></a>
chore: update github/codeql-action action to v4.37.7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21243 ">#21243</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/08de88e50294c4e01f6cae97eceeb578da55792b "><code>08de88e</code></a>
feat: handle underflow in no-loss-of-precision (<a
href="https://redirect.github.com/eslint/eslint/issues/21218 ">#21218</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9ef407a3b051e74f50dc7fb8914e2bd89b3e5e53 "><code>9ef407a</code></a>
docs: use eslint.config.* wherever config file names are listed (<a
href="https://redirect.github.com/eslint/eslint/issues/21216 ">#21216</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.8.0...v10.9.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `jest` from 30.4.2 to 30.5.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/releases ">jest's
releases</a>.</em></p>
<blockquote>
<h2>v30.5.0</h2>
<p>On a personal note: King Harald V of Norway passed away this morning.
He ascended the throne 35 years ago, two months before I was born. This
release is dedicated to his memory. Hvil i fred 🇳🇴 </p>
<hr />
<p>This is a big release. It touches <code>jest-runtime</code>,
<code>jest-resolve</code> and <code>jest-haste-map</code> in many
places, and with this many changes there might be regressions 😬 . If your
suite behaves differently after upgrading, please <a
href="https://github.com/jestjs/jest/issues ">open an issue</a>.</p>
<h1>Highlights</h1>
<h2><code>whenCalledWith</code></h2>
<p>Mock functions can now configure return values per argument list,
contributed by <a
href="https://github.com/timkindberg "><code>@timkindberg</code></a> (<a
href="https://redirect.github.com/jestjs/jest/pull/16053 ">#16053</a>):</p>
<pre lang="js"><code>const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
<p>fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
</code></pre></p>
<p>The returned object is a real <code>Mock</code>, so
<code>mockReturnValueOnce</code>, <code>mockResolvedValue</code>,
<code>mockImplementation</code> etc. all chain here too. Argument slots
accept literals or any asymmetric matcher, with the same equality
semantics as <code>toHaveBeenCalledWith()</code>. Calls that match
nothing fall through to the base mock. See the <a
href="https://jestjs.io/docs/mock-function-api#mockfnwhencalledwithargs ">Mock
Functions docs</a> for matching and precedence details.</p>
<h2>Describe-level retries</h2>
<p><code>jest.retryTimes()</code> can now retry a whole
<code>describe</code> block instead of a single test, contributed by <a
href="https://github.com/soltonigiri "><code>@soltonigiri</code></a> (<a
href="https://redirect.github.com/jestjs/jest/pull/16322 ">#16322</a>).
Each attempt reruns the block's
<code>beforeAll</code>/<code>afterAll</code> hooks, child tests and
nested describes, which helps when tests in a block depend on shared
state:</p>
<pre lang="js"><code>describe('workflow', () => {
jest.retryTimes(3, {entireDescribe: true});
<p>test('first step', () => {});
test('second step', () => {}); // a failure retries the entire block
});
</code></pre></p>
<h2>New file watcher</h2>
<p>The non-watchman path of <code>jest-haste-map</code> is rewritten.
<code>@parcel/watcher</code> replaces the homegrown
<code>NodeWatcher</code> and <code>FSEventsWatcher</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16188 ">#16188</a>),
and <code>fdir</code> replaces the hand-rolled directory recursion in
the crawler (<a
href="https://redirect.github.com/jestjs/jest/pull/16187 ">#16187</a>). A
batch of fixes also makes watching and indexing survive locked files on
Windows, watchman failures, and duplicate manual mocks (<a
href="https://redirect.github.com/jestjs/jest/pull/16295 ">#16295</a>, <a
href="https://redirect.github.com/jestjs/jest/pull/16358 ">#16358</a>, <a
href="https://redirect.github.com/jestjs/jest/pull/16355 ">#16355</a>, <a
href="https://redirect.github.com/jestjs/jest/pull/16360 ">#16360</a>).</p>
<p>If you can, please run your suite with <code>--no-watchman</code> (in
and out of watch mode) to exercise the new crawler and watchers, and
report anything odd 👍 </p>
<h2>Long-requested dependency updates</h2>
<ul>
<li><code>babel-plugin-istanbul</code> is updated to v8 (<a
href="https://redirect.github.com/jestjs/jest/pull/16049 ">#16049</a>)</li>
<li><code>glob</code> is updated to v13 (<a
href="https://redirect.github.com/jestjs/jest/pull/16397 ">#16397</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jestjs/jest/blob/main/CHANGELOG.md ">jest's
changelog</a>.</em></p>
<blockquote>
<h2>30.5.0</h2>
<h3>Features</h3>
<ul>
<li><code>[@jest/expect-utils, jest-mock]</code> Add
<code>mockFn.whenCalledWith(...args)</code> for configuring return
values per argument list, with first-class asymmetric-matcher support
(<a
href="https://redirect.github.com/jestjs/jest/pull/16053 ">#16053</a>)</li>
<li><code>[@jest/expect-utils]</code> Export
<code>AsymmetricMatcher</code> and <code>FunctionParameters</code> types
(previously private to <code>expect</code>) (<a
href="https://redirect.github.com/jestjs/jest/pull/16053 ">#16053</a>)</li>
<li><code>[jest-circus, jest-core, jest-jasmine2, jest-test-result,
jest-types]</code> <code>--collectTests</code> now expands
<code>test.each</code>/<code>describe.each</code> cases and reports
per-status counts (skipped/todo via the new <code>wouldRun</code> flag
for selected tests) plus a summary line that match a real run, including
under <code>--testNamePattern</code> and
<code>.only</code>/<code>fdescribe</code> focus on both the circus and
jasmine2 runners (<a
href="https://redirect.github.com/jestjs/jest/pull/16259 ">#16259</a>)</li>
<li><code>[jest-circus, jest-environment, jest-runtime,
jest-types]</code> Add describe-level retries via
<code>jest.retryTimes(..., {entireDescribe: true})</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16322 ">#16322</a>)</li>
<li><code>[jest-circus, jest-message-util, jest-reporters,
jest-types]</code> Add <code>retryMessages</code> to
<code>AssertionResult</code> and export <code>formatErrorStack</code>,
so the retry log renders nested <code>cause</code> and
<code>AggregateError</code> sections with code frames instead of
serialized <code>[cause]:</code>/<code>[errors]:</code> markers (<a
href="https://redirect.github.com/jestjs/jest/pull/16316 ">#16316</a>)</li>
<li><code>[jest-circus, jest-types]</code> Add
<code>unhandledErrorsDetailed</code> to <code>Circus.RunResult</code>,
so an unhandled rejection reports its <code>cause</code> chain and
<code>AggregateError</code> entries with code frames instead of a
pre-serialized stack (<a
href="https://redirect.github.com/jestjs/jest/pull/16316 ">#16316</a>)</li>
<li><code>[jest-haste-map]</code> Replace <code>NodeWatcher</code> and
<code>FSEventsWatcher</code> with <code>@parcel/watcher</code> for the
non-watchman watch path (<a
href="https://redirect.github.com/jestjs/jest/pull/16188 ">#16188</a>)</li>
<li><code>[jest-resolve]</code> Bump <code>unrs-resolver</code> to
1.12.1, remove <code>jest-pnp-resolver</code> and unnecessary checks (<a
href="https://redirect.github.com/jestjs/jest/pull/15721 ">#15721</a>)</li>
<li><code>[jest-resolve]</code> Honor Node's
<code>--preserve-symlinks</code> / <code>NODE_PRESERVE_SYMLINKS</code>
in the default resolver by passing <code>symlinks: false</code> to
<code>unrs-resolver</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16260 ">#16260</a>)</li>
<li><code>[jest-runtime]</code> Apply automocking and manual
<code>__mocks__</code> files to synchronously evaluable ESM graphs on
Node 24.9+ - static imports, dynamic <code>import()</code> and
<code>require()</code> of an ESM file now generate an automock from the
real module's namespace instead of failing with "Attempting to
import a mock without a factory". Graphs that need async evaluation
(top-level await) or an async-only resolver or transformer still throw
(<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Route
<code>process.getBuiltinModule</code> through the sandbox, so it returns
the sandbox <code>process</code> and the hooked <code>node:module</code>
instead of the host's (<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Throw an actionable error from
<code>module.register()</code> and <code>module.registerHooks()</code>
inside a test - the hooks attached to the loader running Jest itself,
never saw the sandboxed requires they were meant for, and stayed
registered for every later test file in the worker (<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Surface resolution and import-attribute
errors in an ESM graph before executing any of its CJS dependencies on
Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the
legacy loader on older versions keeps its linking-time execution order
(<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Throw
<code>ERR_SOURCE_PHASE_NOT_DEFINED</code> with an actionable message for
<code>import source</code> and <code>import.source()</code>, instead of
failing at instantiation with V8's bare "Source phase import object
is not defined" (<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Emit the JSON-without-import-attribute
deprecation warning once per test file instead of once per worker, so it
is no longer silently swallowed for every file after the first (<a
href="https://redirect.github.com/jestjs/jest/pull/16391 ">#16391</a>)</li>
<li><code>[jest-runtime]</code> Set <code>import.meta.main</code> to
<code>true</code> in the test file and <code>false</code> in every
module it loads, matching Node 24+ (<a
href="https://redirect.github.com/jestjs/jest/pull/16367 ">#16367</a>)</li>
<li><code>[jest-runtime]</code> Resolve the <code>module-sync</code>
export condition, so a package that exposes its ESM entry point for
<code>require()</code> loads the same file Node would (<a
href="https://redirect.github.com/jestjs/jest/pull/16336 ">#16336</a>)</li>
<li><code>[jest-snapshot]</code> Add external snapshot paths to custom
reporter failure details (<a
href="https://redirect.github.com/jestjs/jest/pull/16374 ">#16374</a>)</li>
</ul>
<h3>Fixes</h3>
<ul>
<li><code>[jest-console, jest-reporters]</code>
<code>CustomConsole</code> now buffers console output so
<code>TestResult.console</code> is populated for reporters when
<code>verbose</code> is enabled, while
<code>GitHubActionsReporter</code> avoids replaying buffered output in
verbose mode (<a
href="https://redirect.github.com/jestjs/jest/pull/16155 ">#16155</a>)</li>
<li><code>[expect, jest-message-util, jest-pattern, jest-regex-util,
jest-util]</code> Revert <code>node:</code> protocol imports to restore
webpack/browser-bundle compatibility (<a
href="https://redirect.github.com/jestjs/jest/pull/16167 ">#16167</a>)</li>
<li><code>[expect]</code> Widen <code>toMatchObject</code> and
<code>objectContaining</code> parameter type from
<code>Record<string, unknown></code> to <code>object</code> so
class instances are accepted (<a
href="https://redirect.github.com/jestjs/jest/pull/16196 ">#16196</a>)</li>
<li><code>[jest-circus]</code> Call a generator test body with the
shared test context, so <code>this</code> matches what a regular test
function receives (<a
href="https://redirect.github.com/jestjs/jest/pull/16347 ">#16347</a>)</li>
<li><code>[jest-circus]</code> Capture the error listeners of the parent
process instead of the in-sandbox <code>process</code>, so listeners
registered before the test file survive teardown and sandbox listeners
no longer leak onto the parent (<a
href="https://redirect.github.com/jestjs/jest/pull/16347 ">#16347</a>)</li>
<li><code>[jest-circus]</code> Clear <code>currentlyRunningTest</code>
after skipped and todo tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16342 ">#16342</a>)</li>
<li><code>[jest-circus]</code> Prevent late <code>done()</code>
callbacks from affecting later test or hook invocations (<a
href="https://redirect.github.com/jestjs/jest/pull/16343 ">#16343</a>)</li>
<li><code>[jest-circus, jest-jasmine2]</code> Honor
<code>--expand</code> when formatting <code>node:assert</code> failures,
instead of always collapsing the diff (<a
href="https://redirect.github.com/jestjs/jest/pull/16347 ">#16347</a>)</li>
<li><code>[jest-circus, jest-jasmine2, jest-message-util]</code>
Serialize the inner errors of an <code>AggregateError</code> into
<code>failureMessages</code>, <code>retryReasons</code> and
<code>unhandledErrors</code>, so <code>--json</code> output and reporter
annotations include them (<a
href="https://redirect.github.com/jestjs/jest/pull/16316 ">#16316</a>)</li>
<li><code>[jest-circus, jest-snapshot]</code> Keep snapshot state and
counts correct when a test retries (<a
href="https://redirect.github.com/jestjs/jest/pull/16344 ">#16344</a>)</li>
<li><code>[@jest/create-cache-key-function]</code> Include the caller
support flags in the generated key, so a transformer that emits ESM or
CJS based on them no longer shares one cache entry between the two (<a
href="https://redirect.github.com/jestjs/jest/pull/16331 ">#16331</a>)</li>
<li><code>[@jest/create-cache-key-function]</code> Include the
stringified project config in the generated key, so editing a
transformer's own settings invalidates what it cached (<a
href="https://redirect.github.com/jestjs/jest/pull/16331 ">#16331</a>)</li>
<li><code>[@jest/transform]</code> Include the caller support flags in a
transform's cache key, so a file transformed both as ESM and as CJS no
longer serves one shape's output for the other (<a
href="https://redirect.github.com/jestjs/jest/pull/16331 ">#16331</a>)</li>
<li><code>[jest-config]</code> Add missing
<code>findRelatedTests</code>, <code>outputFile</code>, and
<code>replname</code> entries to <code>ValidConfig</code> so they no
longer trigger spurious "Unknown option" warnings (<a
href="https://redirect.github.com/jestjs/jest/pull/16224 ">#16224</a>)</li>
<li><code>[jest-config]</code> Use <code>--config</code> for the global
config when multiple <code>--projects</code> are specified (<a
href="https://redirect.github.com/jestjs/jest/pull/16273 ">#16273</a>)</li>
<li><code>[jest-core]</code> Serialize <code>bigint</code> values in
<code>--json</code> and <code>--outputFile</code> output as their
literal form (<code>4n</code>), instead of failing the run with
<code>TypeError: Do not know how to serialize a BigInt</code> (<a
href="https://redirect.github.com/jestjs/jest/pull/16338 ">#16338</a>)</li>
<li><code>[jest-core]</code> Do not report a <code>CustomGC</code> async
resource (used by N-API addons such as napi-rs for per-isolate GC
bookkeeping) as an open handle, since it is <code>napi_unref</code>'d by
the addon and can never keep the event loop alive (<a
href="https://redirect.github.com/jestjs/jest/pull/16379 ">#16379</a>)</li>
<li><code>[jest-each]</code> Keep a <code>$&</code>,
<code>$`</code>, <code>$'</code> or <code>$$</code> inside a
<code>%p</code> param value out of the replacement, so the title shows
the value instead of the text around it (<a
href="https://redirect.github.com/jestjs/jest/pull/16338 ">#16338</a>)</li>
<li><code>[jest-each]</code> Interpolate a <code>bigint</code> into a
<code>%j</code> title as its literal form (<code>"4n"</code>)
at any depth, instead of throwing <code>TypeError: Do not know how to
serialize a BigInt</code> while collecting the tests (<a
href="https://redirect.github.com/jestjs/jest/pull/16338 ">#16338</a>)</li>
<li><code>[jest-environment, jest-runtime]</code> Bind
<code>sandboxInjectedGlobals</code> to the right values when
<code>injectGlobals</code> is <code>false</code>, instead of shifting
every one of them by a position (<a
href="https://redirect.github.com/jestjs/jest/pull/16377 ">#16377</a>)</li>
<li><code>[jest-environment-node, jest-util]</code> Only warn about a
conflicting <code>globalsCleanup</code> mode when one was explicitly
configured, and follow the mode that is actually in effect (<a
href="https://redirect.github.com/jestjs/jest/pull/16323 ">#16323</a>)</li>
<li><code>[jest-environment-node, jest-util]</code> Stop resolving lazy
g...
_Description has been truncated_
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:11:18 -07:00
dependabot[bot]
4b29b60d13
chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 2 updates ( #8771 )
...
Bumps the minor-and-patch group in /libs/checkpoint-conformance with 2
updates: [ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:11:11 -07:00
dependabot[bot]
59738d1550
chore(deps-dev): bump the minor-and-patch group in /libs/prebuilt with 3 updates ( #8774 )
...
Bumps the minor-and-patch group in /libs/prebuilt with 3 updates:
[langchain-core](https://github.com/langchain-ai/langchain ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `langchain-core` from 1.5.2 to 1.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.6.1</h2>
<p>Changes since langchain-core==1.6.0</p>
<p>revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)
chore(deps): bump minor and patch dependencies (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39869 ">#39869</a>)
release(core): 1.6.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39832 ">#39832</a>)
feat(core): propagate gateway information on error path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39829 ">#39829</a>)</p>
<h2>langchain-core==1.6.0</h2>
<p>Changes since langchain-core==1.5.6</p>
<p>release(core): 1.6.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39760 ">#39760</a>)
fix(core): resolve postponed annotations in
<code>StructuredTool._injected_args_keys</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39602 ">#39602</a>)
feat(core): add standard model exception types (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39538 ">#39538</a>)
fix(core): allow deserializing <code>RunnablePick</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39753 ">#39753</a>)
fix(core): make <code>convert_to_openai_function</code> handle callables
and non-dict mappings (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39750 ">#39750</a>)
fix(core): make subprocess and temporary file tests portable on Windows
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39664 ">#39664</a>)
fix(core): fail fast when tool schemas can't resolve forward refs during
serialization (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39570 ">#39570</a>)
test(core): avoid version-dependent runnable snapshots (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39705 ">#39705</a>)
fix(core): require all nested properties for strict tool schemas (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39306 ">#39306</a>)
fix(core): remove stale sync-stream <code>xfail</code> [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39720 ">#39720</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39723 ">#39723</a>)
perf(core): Lazily import transformers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38037 ">#38037</a>)
fix(core): accept non-dict Mapping values in mustache templates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39680 ">#39680</a>)
docs(core): clarify <code>Runnable</code> pipe coercion [closes <a
href="https://redirect.github.com/langchain-ai/langchain/issues/39075 ">#39075</a>]
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39707 ">#39707</a>)
fix(core): finalize chain-group runs on <code>BaseException</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39699 ">#39699</a>)</p>
<h2>langchain-core==1.5.6</h2>
<p>Changes since langchain-core==1.5.5</p>
<p>chore(core): release 1.5.6 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39704 ">#39704</a>)
feat(core): incorporate gateway metadata to traces (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39703 ">#39703</a>)</p>
<h2>langchain-core==1.5.5</h2>
<p>Changes since langchain-core==1.5.4</p>
<p>release(core): 1.5.5 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39655 ">#39655</a>)
fix(core): make abatch_iterate consistent with batch_iterate for None
and zero size (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39367 ">#39367</a>)
fix(core): respect pydantic aliases when validating tool inputs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39572 ">#39572</a>)
fix(core): issues in merging chunks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39535 ">#39535</a>)
fix(core): handle v1 base model validation in async path (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39576 ">#39576</a>)
fix(core): handle tool descriptions for infer_schema=False (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39573 ">#39573</a>)
fix(core): clear usage metadata callback on exceptions in context
manager (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39616 ">#39616</a>)
fix(core): handle falsy LLM and chat model caches (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39283 ">#39283</a>)
chore(core): add httpx as an explicit dep (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39612 ">#39612</a>)
fix(core): preserve non-str/non-dict items in
<code>DictPromptTemplate</code> list values (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39588 ">#39588</a>)
fix(core): raise ValueError when explicit tool_outputs length mismatches
tool_calls in tool_example_to_messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39142 ">#39142</a>)
fix(core): guard malformed Anthropic content blocks (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38670 ">#38670</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46 "><code>4fe9d30</code></a>
chore(openai): fix tests (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39972 ">#39972</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c "><code>8fa38dc</code></a>
revert: release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39971 ">#39971</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372 "><code>122030d</code></a>
release(core): 1.6.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39967 ">#39967</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b "><code>7d4b42b</code></a>
release(langchain): 1.3.18 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39966 ">#39966</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83 "><code>4a66e35</code></a>
fix(langchain): preserve content-block shape in PIIMiddleware redaction
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39894 ">#39894</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3 "><code>38e2113</code></a>
fix(core): shore up indexing in genai v1 streaming content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39964 ">#39964</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e "><code>13b1b2f</code></a>
fix(core): make <code>StructuredTool</code> JSON-serializable (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39631 ">#39631</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26 "><code>3b3b308</code></a>
release(anthropic): 1.7.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39963 ">#39963</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4 "><code>e3f6adf</code></a>
feat(anthropic): support top-level param for skills via
<code>container</code>; `updates...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa "><code>c253f54</code></a>
fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and
gpt-5.1 profiles...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.2...langchain-core==1.6.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:11:02 -07:00
dependabot[bot]
2efb0073a5
chore(deps): bump the minor-and-patch group in /libs/checkpoint-postgres with 3 updates ( #8773 )
...
Bumps the minor-and-patch group in /libs/checkpoint-postgres with 3
updates: [orjson](https://github.com/ijl/orjson ),
[ruff](https://github.com/astral-sh/ruff ) and
[ty](https://github.com/astral-sh/ty ).
Updates `orjson` from 3.11.9 to 3.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ijl/orjson/releases ">orjson's
releases</a>.</em></p>
<blockquote>
<h2>3.12.0</h2>
<h3>Changed</h3>
<ul>
<li>Serialization implementation substantially rewritten.</li>
<li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
<code>manylinux_2_39</code> (2024) is targeted instead of
<code>manylinux_2_17</code> (2012).</li>
<li>No longer publish PyPI wheels for ppc64le and s390x.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md ">orjson's
changelog</a>.</em></p>
<blockquote>
<h2>3.12.0 - 2026-08-14</h2>
<h3>Changed</h3>
<ul>
<li>Serialization implementation substantially rewritten.</li>
<li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
<code>manylinux_2_39</code> (2024) is targeted instead of
<code>manylinux_2_17</code> (2012).</li>
<li>No longer publish PyPI wheels for ppc64le and s390x.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ijl/orjson/commit/6737895a1a4e3e26df0569a40147893a786f9a58 "><code>6737895</code></a>
3.12.0</li>
<li><a
href="https://github.com/ijl/orjson/commit/c2a6e8ff7b898635fb68a85bd5a62df1edf61cfc "><code>c2a6e8f</code></a>
JsonWriter, iterators</li>
<li><a
href="https://github.com/ijl/orjson/commit/6a2d7a7d66dc3c5698625a7b334c40db459e46ae "><code>6a2d7a7</code></a>
yyjson 1ea2fb0</li>
<li><a
href="https://github.com/ijl/orjson/commit/97bf170d9726e91c891f35eae4892801520b9dce "><code>97bf170</code></a>
build update</li>
<li>See full diff in <a
href="https://github.com/ijl/orjson/compare/3.11.9...3.12.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.16.0 to 0.16.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>Install ruff 0.16.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm
https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1
| iex"
</code></pre>
<h2>Download ruff 0.16.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.5</h2>
<p>Released on 2026-08-27.</p>
<h3>Preview features</h3>
<ul>
<li>Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28049 ">#28049</a>)</li>
<li>Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27666 ">#27666</a>)</li>
<li>Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27877 ">#27877</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-async</code>] Detect blocking generic HTTP requests
(<code>ASYNC210</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28024 ">#28024</a>)</li>
<li>[<code>flake8-datetimez</code>] Allow timezone-safe
<code>strptime</code> chains (<code>DTZ007</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28023 ">#28023</a>)</li>
<li>[<code>flake8-simplify</code>] Respect side effects in
<code>lambda</code> defaults (<code>SIM401</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28000 ">#28000</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix duplicated "of" in <code>ClientOptions</code> doc
comment (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27978 ">#27978</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27910 ">#27910</a>)</li>
<li>Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27906 ">#27906</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
<li><a
href="https://github.com/jelle-openai "><code>@jelle-openai</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ntBre "><code>@ntBre</code></a></li>
<li><a
href="https://github.com/aarushkandukoori "><code>@aarushkandukoori</code></a></li>
</ul>
<h2>0.16.4</h2>
<p>Released on 2026-08-20.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>flake8-use-pathlib</code>] Add autofix for
<code>PTH116</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26460 ">#26460</a>)</li>
<li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to
lists (<code>FURB131</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27711 ">#27711</a>)</li>
<li>[<code>refurb</code>] Skip <code>FURB101</code> and
<code>FURB103</code> when the <code>open</code> argument is a file
descriptor (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27643 ">#27643</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not
support <code>POPCNT</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27803 ">#27803</a>)</li>
<li>[<code>pyflakes</code>] Emit semantic syntax errors in string type
definitions as <code>F722</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27835 ">#27835</a>)</li>
<li>[<code>pylint</code>] Allow <code>os._exit</code> imports in
<code>import-private-name</code> (<code>PLC2701</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27738 ">#27738</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a "><code>9e4938c</code></a>
Bump 0.16.5 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28110 ">#28110</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd "><code>aad0e90</code></a>
Allow rules without codes (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28049 ">#28049</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4 "><code>5fdab73</code></a>
Update preview default rules and categories (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27877 ">#27877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4 "><code>29c8e5b</code></a>
Document rule acceptance guidelines (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27910 ">#27910</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f "><code>50a4d7f</code></a>
Document the new category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27906 ">#27906</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2 "><code>ada8795</code></a>
Introduce category selectors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27666 ">#27666</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0 "><code>d894723</code></a>
[ty] Infer lambda parameters through callable type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28109 ">#28109</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06 "><code>2685fde</code></a>
[ty] Narrow functional enum members in <code>==</code> and
<code>match</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28103 ">#28103</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec "><code>efcffd2</code></a>
[ty] Intersection simplifications with subtype-related generic
specialization...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b "><code>eb78048</code></a>
[ty] Bump ecosystem-analyzer for HTML escaping (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28104 ">#28104</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.64 to 0.0.75
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.75</h2>
<p>Released on 2026-08-26.</p>
<h3>Preview features</h3>
<ul>
<li>Initialize PEP 723 script environments in the CLI (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27544 ">#27544</a>)</li>
<li>Refresh PEP 723 script environments in watch mode (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27617 ">#27617</a>)</li>
<li>Run PEP 723 script synchronization on bounded workers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27615 ">#27615</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Specialize <code>Self</code> bounds of inherited methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27990 ">#27990</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Add "Go to Definition" support for pytest fixtures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27444 ">#27444</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/pull/4384 ">#4384</a>)</li>
<li>Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/pull/4382 ">#4382</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Resolve imported pytest fixture exposures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27539 ">#27539</a>)</li>
<li>Resolve installed core pytest fixture providers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27770 ">#27770</a>)</li>
<li>Resolve pytest fixtures through conftest (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27540 ">#27540</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add more autofixes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28029 ">#28029</a>)</li>
<li>Add a dedicated missing-slot diagnostic (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28039 ">#28039</a>)</li>
<li>Explain missing storage for declared slotted attributes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27969 ">#27969</a>)</li>
<li>Improve diagnostic spans for unpacked variable assignments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28041 ">#28041</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Account for known subclasses in equality inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28005 ">#28005</a>)</li>
<li>Expand <code>ParamSpec</code> signatures inferred from bound
receivers (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28020 ">#28020</a>)</li>
<li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/28016 ">#28016</a>)</li>
<li>Fix <code>TypedDict</code> variance inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28052 ">#28052</a>)</li>
<li>Fix unsound narrowing through branch-assigned conditions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28006 ">#28006</a>)</li>
<li>Ignore inconsistent binding decorators on overloads (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28036 ">#28036</a>)</li>
<li>Infer <code>yield from</code> send/return types from the iterator
returned by <code>__iter__</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27987 ">#27987</a>)</li>
<li>Infer tuple type parameters from union arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28062 ">#28062</a>)</li>
<li>Infer variance through nonrecursive protocol references (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28065 ">#28065</a>)</li>
<li>Preserve bounds of non-literal metaclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28046 ">#28046</a>)</li>
<li>Preserve correlated generic-call inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28043 ">#28043</a>)</li>
<li>Preserve invariant materialization constraints (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28047 ">#28047</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d "><code>a553dcc</code></a>
Bump version to 0.0.75 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4396 ">#4396</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4 "><code>26b1b50</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4392 ">#4392</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315 "><code>73d226e</code></a>
Fix documented Python package build command (<a
href="https://redirect.github.com/astral-sh/ty/issues/4384 ">#4384</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9 "><code>5e264da</code></a>
Link untyped-call tracking issue in migration guide (<a
href="https://redirect.github.com/astral-sh/ty/issues/4382 ">#4382</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17 "><code>00199f0</code></a>
Bump version to 0.0.74 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4351 ">#4351</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63 "><code>5769062</code></a>
Update mypy/pyright comparison table (<a
href="https://redirect.github.com/astral-sh/ty/issues/4165 ">#4165</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866 "><code>4fcb060</code></a>
Remove Zulip from the PGO training (<a
href="https://redirect.github.com/astral-sh/ty/issues/4336 ">#4336</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6 "><code>a7a7064</code></a>
Use the versions bot's ruleset bypass when merging (<a
href="https://redirect.github.com/astral-sh/ty/issues/4333 ">#4333</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8 "><code>01b0fab</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4325 ">#4325</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab "><code>deef42f</code></a>
Update dependency python to 3.14 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4326 ">#4326</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:10:58 -07:00
dependabot[bot]
408e964501
chore(deps): bump dorny/paths-filter from 4.0.2 to 4.0.3 in the minor-and-patch group ( #8770 )
...
Bumps the minor-and-patch group with 1 update:
[dorny/paths-filter](https://github.com/dorny/paths-filter ).
Updates `dorny/paths-filter` from 4.0.2 to 4.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/releases ">dorny/paths-filter's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update Outputs in readme to account for the 'every'
predicate-quantifier by <a
href="https://github.com/hintron "><code>@hintron</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/247 ">dorny/paths-filter#247</a></li>
<li>fix: scope base-ignored warning to API path by <a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/319 ">dorny/paths-filter#319</a></li>
<li>docs: add contents permission to PR example by <a
href="https://github.com/134130 "><code>@134130</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/248 ">dorny/paths-filter#248</a></li>
<li>feat: add 'some-with-excludes' predicate quantifier by <a
href="https://github.com/arxeiss "><code>@arxeiss</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/322 ">dorny/paths-filter#322</a></li>
<li>Document safe handling of file list outputs in workflows by <a
href="https://github.com/dorny "><code>@dorny</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/326 ">dorny/paths-filter#326</a></li>
</ul>
<h2>Security</h2>
<ul>
<li>Escape multi-line filenames in list-files shell and csv output] by
<a href="https://github.com/ken-matsui "><code>@ken-matsui</code></a>
and <a href="https://github.com/tjswlsgg "><code>@tjswlsgg</code></a> in
<a
href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m ">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m </a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/hintron "><code>@hintron</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/247 ">dorny/paths-filter#247</a></li>
<li><a href="https://github.com/134130 "><code>@134130</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/248 ">dorny/paths-filter#248</a></li>
<li><a href="https://github.com/arxeiss "><code>@arxeiss</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/322 ">dorny/paths-filter#322</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3 ">https://github.com/dorny/paths-filter/compare/v4...v4.0.3 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md ">dorny/paths-filter's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.0.3</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/326 ">Document
safe handling of file list outputs in workflows</a></li>
<li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m ">Escape
multi-line filenames in list-files shell and csv output</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/322 ">Add
'some-with-excludes' predicate quantifier</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/248 ">Add
contents permission to PR example</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/319 ">Scope
base-ignored warning to API path</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/247 ">Update
outputs in readme to account for the 'every'
predicate-quantifier</a></li>
</ul>
<h2>v4.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/317 ">Work
around git dubious ownership errors in container jobs</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/303 ">Use
rev-parse instead of branch --show-current for older git compat</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/282 ">Fix
warning message</a></li>
</ul>
<h2>v4.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/255 ">Support
merge queue</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/294 ">Update
action runtime to node24</a></li>
</ul>
<h2>v3.0.4</h2>
<ul>
<li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m ">Escape
multi-line filenames in list-files shell and csv output</a></li>
</ul>
<h2>v3.0.3</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/279 ">Add
missing predicate-quantifier</a></li>
</ul>
<h2>v3.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/224 ">Add
config parameter for predicate quantifier</a></li>
</ul>
<h2>v3.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/133 ">Compare
base and ref when token is empty</a></li>
</ul>
<h2>v3.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/210 ">Update to
Node.js 20</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/215 ">Update
all dependencies</a></li>
</ul>
<h2>v2.11.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/167 ">Update
@actions/core to v1.10.0 - Fixes warning about deprecated
set-output</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/168 ">Document
need for pull-requests: read permission</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/164 ">Updating
to actions/checkout@v3</a></li>
</ul>
<h2>v2.11.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/157 ">Set
list-files input parameter as not required</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/161 ">Update
Node.js</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/162 ">Fix
incorrect handling of Unicode characters in exec()</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/163 ">Use
Octokit pagination</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/160 ">Updates
real world links</a></li>
</ul>
<h2>v2.10.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d "><code>ceb8a2b</code></a>
Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a
href="https://redirect.github.com/dorny/paths-filter/issues/327 ">#327</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1 "><code>ef09b88</code></a>
Document safe handling of file list outputs in workflows (<a
href="https://redirect.github.com/dorny/paths-filter/issues/326 ">#326</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d "><code>44adc5b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7 "><code>4711b7a</code></a>
feat: add 'some-with-excludes' predicate quantifier (<a
href="https://redirect.github.com/dorny/paths-filter/issues/322 ">#322</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a "><code>93c889f</code></a>
fix: escape multi-line filenames in list-files shell and csv output</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03 "><code>b41dfa9</code></a>
docs: add contents permission to PR example (<a
href="https://redirect.github.com/dorny/paths-filter/issues/248 ">#248</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402 "><code>9af6e5a</code></a>
fix: scope base-ignored warning to API path (<a
href="https://redirect.github.com/dorny/paths-filter/issues/319 ">#319</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7 "><code>cae9006</code></a>
docs: update outputs in readme to account for the 'every'
predicate-quantifie...</li>
<li>See full diff in <a
href="https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 01:10:35 -07:00
navarra-lisandro and Mason Daugherty
11ee185999
fix(checkpoint): widen Store put value type to Mapping[str, Any] ( #8617 )
...
TypedDict values don't structurally satisfy dict[str, Any] since dict
implies full mutability. Mapping[str, Any] accepts both plain dicts and
TypedDicts while still requiring string keys, matching what put()
actually needs from callers.
Fixes #8616
Verified by running lint/type/test locally across checkpoint,
checkpoint-sqlite, checkpoint-postgres, prebuilt, sdk-py, and a scoped
langgraph subset.
LinkedIn: https://linkedin.com/in/lisandro-navarra
---------
Co-authored-by: Mason Daugherty <github@mdrxy.com >
2026-08-28 08:05:04 -05:00
Sreekara Yachamaneni
d5f4b2aa96
release(sdk-py): 0.4.4 ( #8738 )
...
Bumps the Python SDK version from 0.4.3 to 0.4.4.
2026-08-27 17:14:54 -04:00
Sreekara Yachamaneni
5a77be5e8b
Merge commit from fork
...
* authz fix for custom auth
* add back resource param
* auth on multiple resources
2026-08-27 13:28:59 -07:00
Mason Daugherty and open-swe[bot]
bdb8a9c7a4
feat: route LangSmith traces from thread streams ( #8723 )
...
## Description
Expose the existing `langsmith_tracing` option on Python sync and async
thread-stream run starts and forward it through the protocol.
## Release Note
Python thread streams can route traces to an additional LangSmith
project per run.
## Test Plan
- [x] Verify sync and async run-start payloads include tracing settings
## Related PRs
- langchain-ai/agent-protocol#95
- langchain-ai/langgraphjs#2745
- langchain-ai/langgraph-api#4033
Made by [Open
SWE](https://openswe.vercel.app/agents/f9e34294-b9c3-52f0-815a-0102188e1181 )
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-08-26 16:57:39 -04:00
John Kennedy and langsmith-fleet[bot]
38031739e5
docs: add Corridor agent instructions ( #8677 )
...
Add a repository-wide `<corridor>` block to `AGENTS.md` requiring agents
to plan first and run Corridor `analyzePlan` before generating or
modifying code. The tags are explicit and balanced so Corridor-specific
guidance remains scoped.
Validation: `git diff --check` and a tag-balance assertion.
---------
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
2026-08-24 14:42:27 -07:00
dependabot[bot]
f09cfe8ffc
chore(deps): bump langgraph-checkpoint-postgres from 3.0.5 to 3.1.1 in /libs/cli/uv-examples/monorepo in the uv group across 1 directory ( #8646 )
...
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo
directory:
[langgraph-checkpoint-postgres](https://github.com/langchain-ai/langgraph ).
Updates `langgraph-checkpoint-postgres` from 3.0.5 to 3.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraph/releases ">langgraph-checkpoint-postgres's
releases</a>.</em></p>
<blockquote>
<h2>langgraph-checkpoint-postgres==3.1.1</h2>
<p>Changes since checkpointpostgres==3.1.0</p>
<ul>
<li>release(checkpoint-postgres): 3.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8480 ">#8480</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): scope namespace matching
to segment boundaries (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8478 ">#8478</a>)</li>
<li>feat(checkpoint,checkpoint-postgres): add opt-in omit_expired to
skip expired rows on read (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8354 ">#8354</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 5 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8250 ">#8250</a>)</li>
<li>chore(deps): bump langsmith from 0.8.0 to 0.8.18 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8171 ">#8171</a>)</li>
<li>docs: standardize package <code>README.md</code> structure (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8064 ">#8064</a>)</li>
<li>chore: migrate Python type checking to ty (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8002 ">#8002</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-postgres with 7 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7965 ">#7965</a>)</li>
<li>release(checkpoint): 4.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7890 ">#7890</a>)</li>
<li>chore(deps): bump idna from 3.11 to 3.15 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7861 ">#7861</a>)</li>
<li>chore(deps): bump langsmith from 0.7.31 to 0.8.0 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7785 ">#7785</a>)</li>
</ul>
<h2>langgraph-checkpoint-sqlite==3.1.1</h2>
<p>Changes since checkpointsqlite==3.1.0</p>
<ul>
<li>release(checkpoint-sqlite): 3.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8481 ">#8481</a>)</li>
<li>fix(checkpoint-postgres,checkpoint-sqlite): scope namespace matching
to segment boundaries (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8478 ">#8478</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 4 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8249 ">#8249</a>)</li>
<li>chore(deps): bump langsmith from 0.8.0 to 0.8.18 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8177 ">#8177</a>)</li>
<li>docs: standardize package <code>README.md</code> structure (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8064 ">#8064</a>)</li>
<li>chore: migrate Python type checking to ty (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8002 ">#8002</a>)</li>
<li>chore(deps): bump the minor-and-patch group in
/libs/checkpoint-sqlite with 3 updates (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7961 ">#7961</a>)</li>
<li>release(checkpoint): 4.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7890 ">#7890</a>)</li>
<li>chore(deps): bump langsmith from 0.7.31 to 0.8.0 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7786 ">#7786</a>)</li>
<li>chore(deps): bump idna from 3.11 to 3.15 in /libs/checkpoint-sqlite
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7862 ">#7862</a>)</li>
</ul>
<h2>langgraph-checkpoint-postgres==3.1.0</h2>
<p>Changes since checkpointpostgres==3.1.0a4</p>
<ul>
<li>release: bump alpha packages to official versions (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7775 ">#7775</a>)</li>
<li>chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7761 ">#7761</a>)</li>
<li>chore(deps): bump langchain-core from 1.3.2 to 1.3.3 in
/libs/checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7754 ">#7754</a>)</li>
<li>fix(checkpoint-postgres): add column aliases to seed-blob branch of
delta stage-2 UNION ALL (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7728 ">#7728</a>)</li>
</ul>
<h2>langgraph-checkpoint-sqlite==3.1.0</h2>
<p>Changes since checkpointsqlite==3.1.0a1</p>
<ul>
<li>release: bump alpha packages to official versions (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7775 ">#7775</a>)</li>
<li>chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7760 ">#7760</a>)</li>
<li>chore(deps): bump langchain-core from 1.2.28 to 1.3.3 in
/libs/checkpoint-sqlite (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7751 ">#7751</a>)</li>
<li>chore: remove keepset helper (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7745 ">#7745</a>)</li>
<li>chore(langgraph): add guide/conformance for delta channel
checkpointer (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7736 ">#7736</a>)</li>
</ul>
<h2>langgraph-checkpoint-postgres==3.1.0a4</h2>
<p>Changes since checkpointpostgres==3.1.0a3</p>
<ul>
<li>release: alpha bump (a4) for langgraph, checkpoint,
checkpoint-postgres (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/7701 ">#7701</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/b2926a0ff9589c28c7e01fe7cdbb337b86d5a4b4 "><code>b2926a0</code></a>
release(checkpoint-sqlite): 3.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8481 ">#8481</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/fcdf520938469c8e0992ca2075d6a9582c33260f "><code>fcdf520</code></a>
release(checkpoint-postgres): 3.1.1 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8480 ">#8480</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/66ebe1a0da921e73f0f9f879ba105d314c079f7c "><code>66ebe1a</code></a>
fix(checkpoint-postgres,checkpoint-sqlite): scope namespace matching to
segme...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/41341457342327166d72fc11952ab28fb61ec0bf "><code>4134145</code></a>
release(langgraph): 1.2.10 (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8462 ">#8462</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/30c4d58db86455128e42ddec96b1ba53c553ba22 "><code>30c4d58</code></a>
chore(deps): bump jupyterlab from 4.5.9 to 4.5.10 in /libs/langgraph (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8440 ">#8440</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1f2f88b2b74aa4e26c6a8be877dcb95bad2cef48 "><code>1f2f88b</code></a>
chore(deps): bump js-yaml from 4.2.0 to 4.3.0 in
/libs/cli/js-monorepo-exampl...</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/270820363d56cf8a8e594d2d3b19d543230337fb "><code>2708203</code></a>
chore(deps): bump setuptools from 82.0.1 to 83.0.0 in /libs/cli (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8434 ">#8434</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/9f1e40bfeea28dee2155b4a57f5babd0a53534cf "><code>9f1e40b</code></a>
chore(deps): bump setuptools from 80.9.0 to 83.0.0 in /libs/langgraph
(<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8435 ">#8435</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/1e1ca88dad9c7e708263257fa9fc27a3fbdfff68 "><code>1e1ca88</code></a>
feat(langgraph): type v3 stream_events return and native projections (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8389 ">#8389</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraph/commit/31f90df3e6b0268fa77fd2d118a917d420b84a68 "><code>31f90df</code></a>
revert(langgraph): delete TracePolicy (<a
href="https://redirect.github.com/langchain-ai/langgraph/issues/8403 ">#8403</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langgraph/compare/checkpointpostgres==3.0.5...checkpointsqlite==3.1.1 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-20 07:02:48 +00:00
Connor Braa
837212b969
release(sdk-py): 0.4.3 ( #8657 )
...
## Summary
Release `langgraph-sdk` 0.4.3, including `DecryptResult` support.
## Test plan
- `make format`
- `make lint`
- `make test`
2026-08-19 10:59:36 -07:00
Connor Braa
70918557ca
feat(sdk-py): add decrypt replacement result ( #8598 )
...
## Summary
- add `DecryptResult` with plaintext and optional replacement ciphertext
- keep raw decrypt return values backward compatible
- export the result from `langgraph_sdk`
## Merge order
Independent of langgraph-api#3884. Merge and release this SDK change
before LSD-1489 consumes the result in langgraph-api.
## Test plan
- `make format`
- `make lint`
- `make test`
2026-08-19 10:45:55 -07:00
Igor Soarez and Elior Nataf Lackritz
1e44bda48f
fix(langgraph): detect subgraphs from bytecode instead of source ( #8569 )
...
Fixes langchain-ai/langgraph#8559
`find_subgraph_pregel` runs once per node at build time and recovers
each node function's reachable values with `inspect.getsource` +
`ast.parse`; langchain-ai/langgraph#8559 measures that source parsing at
80% of `StateGraph.compile()`. This replaces it with a `dis` walk over
`func.__code__`, which reads the same information already in memory.
Closure cells and the globals named in `co_names` supply the values
directly, and a walk over the instruction stream recovers the attribute
paths the function actually takes. The closure alone cannot express
those: a captured `holder` whose graph lives at `holder.graph` is
reachable only if something records that `graph` is loaded off `holder`.
Both implementations over-declare — a node can reference a graph it
never invokes — and this one over-declares a different set. It no longer
reports a graph named only along an attribute path in code the compiler
removed; such a path cannot execute, so that entry was always a phantom.
Nothing that can actually run stopped being detected.
`find_subgraph_pregel` returns the first `PregelProtocol` it finds, so
the remaining extra candidates only widen detection.
## Release note
Subgraph auto-detection now reads node functions' bytecode instead of
parsing their source. Graph builds with many function-backed nodes are
substantially faster, and subgraphs are now detected inside functions
with no retrievable source — defined in a REPL or notebook cell, or via
`exec` — where detection previously failed silently and returned
nothing.
## Performance
Against
[langgraph-build-bench](<https://github.com/soarez/langgraph-build-bench >)
— 713 nodes, 500 state fields, 264 tools; CPython 3.12.8, Apple silicon:
```
before build 1412 ms subgraph detection 1132 ms (80%)
after build 286 ms subgraph detection 4 ms (2%)
```
**4.9x on total build, \~266x on detection.** The bench prints whole ms;
at full precision detection is 1139 ms -> 4.23 ms.
Co-authored-by: Elior Nataf Lackritz <elior.nataflackritz@langchain.dev >
2026-08-18 12:04:28 -07:00
ccurme
644815f9e5
release(langgraph): 1.2.11 ( #8595 )
2026-08-11 09:55:59 -04:00
ccurme
7d6b5790ba
feat(langgraph): expose trace_policy on add_node ( #8523 )
2026-08-11 09:19:43 -04:00
d56666f7fb
chore(deps): bump the minor-and-patch group across 1 directory with 7 updates ( #8533 )
...
Bumps the minor-and-patch group with 7 updates in the /libs/langgraph
directory:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.4.8`
| `1.5.3` |
| [xxhash](https://github.com/ifduyue/python-xxhash ) | `3.8.0` | `3.8.1`
|
| [syrupy](https://github.com/syrupy-project/syrupy ) | `5.3.4` | `5.5.3`
|
| [redis](https://github.com/redis/redis-py ) | `8.0.1` | `8.1.0` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.15.20` | `0.16.1` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.55` | `0.0.66` |
| [anyio](https://github.com/agronholm/anyio ) | `4.14.1` | `4.14.2` |
Updates `langchain-core` from 1.4.8 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.3</h2>
<p>Changes since langchain-core==1.5.2</p>
<p>release(core): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39145 ">#39145</a>)
fix(core): fall back to <code>LANGSMITH_API_KEY</code> for gateway (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39115 ">#39115</a>)</p>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/01d8481ae3d457ec3751cbb0331ea3a4b720fa90 "><code>01d8481</code></a>
release(core): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39145 ">#39145</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b8a6e36d3f810302c66065ea1c2892da000de550 "><code>b8a6e36</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39141 ">#39141</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/cdca311de2958e497cfd823a45ddb770d0ef94c0 "><code>cdca311</code></a>
fix(core): fall back to <code>LANGSMITH_API_KEY</code> for gateway (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39115 ">#39115</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a5a8762436658b218dbfc5efff9e8ab8fabbe62f "><code>a5a8762</code></a>
ci: annotate uv bump workflow with PR links (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39112 ">#39112</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/557c0a986d5068085a945dcb3c9ce27257c4add8 "><code>557c0a9</code></a>
chore(deps): bump uv to 0.12.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39111 ">#39111</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/835c85ae236a2d33cd11de4c98d28cbc6ebbd72f "><code>835c85a</code></a>
release(anthropic): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39109 ">#39109</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `xxhash` from 3.8.0 to 3.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/releases ">xxhash's
releases</a>.</em></p>
<blockquote>
<h2>v3.8.1</h2>
<ul>
<li>Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning</li>
<li>Update C extension docstrings and remove stale comments</li>
</ul>
<hr />
<p>Full list of changes: <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst ">xxhash's
changelog</a>.</em></p>
<blockquote>
<p>v3.8.1 2026-07-06</p>
<pre><code>
- Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning
- Update C extension docstrings and remove stale comments
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/0a1adf7b6a5f26b821272985a0a987cca5446c23 "><code>0a1adf7</code></a>
Release v3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa419ca1478219b7ba2ad18a8fe05ca9d29288bc "><code>aa419ca</code></a>
Prepare 3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/e26b770f19b5eabd1c58d098206e5c9adfcef5d1 "><code>e26b770</code></a>
docs: update C extension docstrings and remove stale comments</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa69707513c4ba8c52a4bebc23f0aada7844decc "><code>aa69707</code></a>
Register the “benchmark” pytest mark</li>
<li>See full diff in <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 5.3.4 to 5.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.3</h2>
<h2>What's Changed</h2>
<p>This release has no functional changes. It just fixes an issue where
the release tag pointed to the previous commit instead of the commit
with the updated pyproject.toml (see <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">syrupy-project/syrupy#1144</a>).</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 ">https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 </a></p>
<h2>v5.5.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> by <a
href="https://github.com/mgorny "><code>@mgorny</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mgorny "><code>@mgorny</code></a> made
their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 ">https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 </a></p>
<h2>v5.5.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Defer registering <code>pytest-xdist</code> hook
<code>pytest_testnodedown</code> to avoid "unknown hook" error
by <a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 ">https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 </a></p>
<h2>v5.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: detect unused snapshots under pytest-xdist by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1132 ">syrupy-project/syrupy#1132</a></li>
</ul>
<blockquote>
<p><strong>NOTE</strong>: Test suites using pytest-xdist that previously
passed due to incomplete snapshot support may now fail if unused
snapshots are detected. You can use <code>--snapshot-warn-unused</code>
to downgrade unused snapshot detection from an error to a warning though
it's not recommended.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 ">https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 </a></p>
<h2>v5.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: add --snapshot-no-cleanup to keep unused snapshots on update
by <a href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1126 ">syrupy-project/syrupy#1126</a></li>
<li>fix: honor boolean operators in -k snapshot selection by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1127 ">syrupy-project/syrupy#1127</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.4.0 ">https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.4.0 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.3 ">v5.5.3</a>
(2026-07-11)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1143 ">syrupy-project/syrupy#1143</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1145 ">syrupy-project/syrupy#1145</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1147 ">syrupy-project/syrupy#1147</a></li>
<li>chore(deps): update dependency mypy to v2.2.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1148 ">syrupy-project/syrupy#1148</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1150 ">syrupy-project/syrupy#1150</a></li>
<li>chore: closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">#1144</a>
by <a href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1146 ">syrupy-project/syrupy#1146</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1149 ">syrupy-project/syrupy#1149</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 ">https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.2 ">v5.5.2</a>
(2026-07-08)</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> by <a
href="https://github.com/mgorny "><code>@mgorny</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mgorny "><code>@mgorny</code></a> made
their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 ">https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.1 ">v5.5.1</a>
(2026-07-06)</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Defer registering <code>pytest-xdist</code> hook
<code>pytest_testnodedown</code> to avoid "unknown hook" error
by <a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 ">https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.0 ">v5.5.0</a>
(2026-07-06)</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: detect unused snapshots under pytest-xdist by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1132 ">syrupy-project/syrupy#1132</a></li>
</ul>
<blockquote>
<p><strong>NOTE</strong>: Test suites using pytest-xdist that previously
passed due to incomplete snapshot support may now fail if unused
snapshots are detected. You can use <code>--snapshot-warn-unused</code>
to downgrade unused snapshot detection from an error to a warning though
it's not recommended.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 ">https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.4.0 ">v5.4.0</a>
(2026-07-01)</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: add --snapshot-no-cleanup to keep unused snapshots on update
by <a href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1126 ">syrupy-project/syrupy#1126</a></li>
<li>fix: honor boolean operators in -k snapshot selection by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1127 ">syrupy-project/syrupy#1127</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3cd347306cf44db076d2e4f50f7dfd325d9b5a92 "><code>3cd3473</code></a>
chore(release): 5.5.3 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/fed7e9f69f4dd14b39360e626236c868147588d5 "><code>fed7e9f</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.2 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1149 ">#1149</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/443fc11bf67ce588753cd4518ef056463cfe651b "><code>443fc11</code></a>
chore: closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">#1144</a>
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1146 ">#1146</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/56bf157ce4135bde78ecc49cfa9532ffa41659e8 "><code>56bf157</code></a>
chore(deps): update dependency hypothesis to v6.156.3 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1150 ">#1150</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/f9c725a5653677bfcafb53645c9a078f3aa79d87 "><code>f9c725a</code></a>
chore(deps): update dependency mypy to v2.2.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1148 ">#1148</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3af2ccf2feeadb3a0d4e3f418d22ad3395725c80 "><code>3af2ccf</code></a>
chore(deps): update dependency hypothesis to v6.156.2 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1147 ">#1147</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/feaa22ca4c211dfcdd8d0d048112531fd6cb344c "><code>feaa22c</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1145 ">#1145</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/5c59701e411922a464497398f5df25d76f2f9dcd "><code>5c59701</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1143 ">#1143</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/1cbf7167ff114e3012b1c139661777c1a0b692ee "><code>1cbf716</code></a>
chore(release): 5.5.2 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4f83490d2ebf4ae22aeba6d9946979640151aa34 "><code>4f83490</code></a>
fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1142 ">#1142</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.5.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `redis` from 8.0.1 to 8.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/redis/redis-py/releases ">redis's
releases</a>.</em></p>
<blockquote>
<h2>8.1.0</h2>
<h1>Changes</h1>
<h2>✨ Highlights</h2>
<h3>Async maintenance notifications</h3>
<p>redis-py now supports server-pushed <strong>maintenance
notifications</strong> in the asyncio stack for both
standalone and cluster clients, bringing the async client to parity with
the sync implementation.
When a Redis deployment signals maintenance events (such as node
migration or failover windows), the
async client reacts through the maintenance-notifications handler
(<code>redis/maint_notifications.py</code> and
its async integration under <code>redis/asyncio/</code>), allowing
applications to adapt connection handling
during maintenance without downtime. (<a
href="https://redirect.github.com/redis/redis-py/issues/4177 ">#4177</a>)</p>
<h3>Expanded command coverage</h3>
<p>This release adds a batch of new command surfaces across core data
types and modules:</p>
<ul>
<li><strong>Lists</strong> — <code>LMOVEM</code> / <code>BLMOVEM</code>
for moving multiple elements between lists (<a
href="https://redirect.github.com/redis/redis-py/issues/4174 ">#4174</a>).</li>
<li><strong>Sets</strong> — <code>SDIFFCARD</code> and
<code>SUNIONCARD</code> cardinality commands (<a
href="https://redirect.github.com/redis/redis-py/issues/4171 ">#4171</a>).</li>
<li><strong>Streams</strong> — <code>MAXCOUNT</code> /
<code>MAXSIZE</code> options for <code>XREAD</code> and
<code>XREADGROUP</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4173 ">#4173</a>).</li>
<li><strong>Time Series</strong> — <code>TS.READ</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4170 ">#4170</a>),
<code>TS.QUERYLABELS</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4197 ">#4197</a>),
<code>TS.NRANGE</code> / <code>TS.NREVRANGE</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4163 ">#4163</a>),
and an <code>exclude_empty</code> (<code>EXCLUDEEMPTY</code>) option for
<code>TS.MRANGE</code> / <code>TS.MREVRANGE</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4188 ">#4188</a>).</li>
<li><strong>Search</strong> — <code>FT.ALIASLIST</code> (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)
and a <code>COLLECT</code> reducer for aggregations (<a
href="https://redirect.github.com/redis/redis-py/issues/4179 ">#4179</a>).</li>
<li><strong>Sentinel</strong> — replica sentinel aliases (<a
href="https://redirect.github.com/redis/redis-py/issues/4127 ">#4127</a>).</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>Add replica sentinel aliases (<a
href="https://redirect.github.com/redis/redis-py/issues/4127 ">#4127</a>)</li>
<li>Add TS.NRANGE and TS.NREVRANGE support to the timeseries command
surface (<a
href="https://redirect.github.com/redis/redis-py/issues/4163 ">#4163</a>)</li>
<li>feat: add TS.READ command support to the timeseries module (<a
href="https://redirect.github.com/redis/redis-py/issues/4170 ">#4170</a>)</li>
<li>feat: add SDIFFCARD and SUNIONCARD command support (<a
href="https://redirect.github.com/redis/redis-py/issues/4171 ">#4171</a>)</li>
<li>feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (<a
href="https://redirect.github.com/redis/redis-py/issues/4173 ">#4173</a>)</li>
<li>feat: add LMOVEM and BLMOVEM commands for moving multiple list
elements (<a
href="https://redirect.github.com/redis/redis-py/issues/4174 ">#4174</a>)</li>
<li>feat: add async maintenance-notifications support for standalone and
cluster clients (<a
href="https://redirect.github.com/redis/redis-py/issues/4177 ">#4177</a>)</li>
<li>feat: add COLLECT reducer support to search aggregations (<a
href="https://redirect.github.com/redis/redis-py/issues/4179 ">#4179</a>)</li>
<li>feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and
TS.MREVRANGE (<a
href="https://redirect.github.com/redis/redis-py/issues/4188 ">#4188</a>)</li>
<li>feat: add TS.QUERYLABELS support to the timeseries command surface
(<a
href="https://redirect.github.com/redis/redis-py/issues/4197 ">#4197</a>)</li>
<li>feat: add FT.ALIASLIST support (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)</li>
</ul>
<h2>⚠️ Experimental</h2>
<ul>
<li>feat: add client-side HIMPORT fieldset support for standalone and
cluster clients (<a
href="https://redirect.github.com/redis/redis-py/issues/4205 ">#4205</a>)</li>
</ul>
<p>The feature considered unstable and <strong>public API might be
changed in the future minor version</strong></p>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: detect closed pooled connection without consuming pending push
data (RESP3 + hiredis) (<a
href="https://redirect.github.com/redis/redis-py/issues/4156 ">#4156</a>)</li>
<li>Fix Sentinel pool capacity loss after failover (<a
href="https://redirect.github.com/redis/redis-py/issues/4193 ">#4193</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/redis/redis-py/commit/e013126df18e476fbb8b8215f040f39bd3242683 "><code>e013126</code></a>
Testing with 8.10 GA (<a
href="https://redirect.github.com/redis/redis-py/issues/4227 ">#4227</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/059d1e97d88dd7ed516628e0a9765ab8e0e299f1 "><code>059d1e9</code></a>
Fixed TS.NRANGE commands to correctly apply aggregators (<a
href="https://redirect.github.com/redis/redis-py/issues/4225 ">#4225</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/d486a0a982dcdf316006474dc286ca65cbec5a9f "><code>d486a0a</code></a>
Fix FIELDNAME alias dropping first character of un-prefixed fields (<a
href="https://redirect.github.com/redis/redis-py/issues/4224 ">#4224</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/fb931042420baaa5fbb9021955e444f7afa66dc2 "><code>fb93104</code></a>
feat: add client-side HIMPORT fieldset support for standalone and
cluster cli...</li>
<li><a
href="https://github.com/redis/redis-py/commit/9197609f48eb9713411a50534ca48210486a4bf9 "><code>9197609</code></a>
Fix lat/lon swap in search querystring geo() helper (<a
href="https://redirect.github.com/redis/redis-py/issues/4223 ">#4223</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/14714a0812d3ff03ad34c89ce6f79e287a04e9fb "><code>14714a0</code></a>
fix: Fixed double decoding issue with unquote() (<a
href="https://redirect.github.com/redis/redis-py/issues/4222 ">#4222</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/227280a939718d09ff9d7c41f9785ffdc21bdc2a "><code>227280a</code></a>
Update lib version to 8.1.0</li>
<li><a
href="https://github.com/redis/redis-py/commit/88d16d0db10c852d1d292628b2c832f1ed117056 "><code>88d16d0</code></a>
Decode ACL LOG string values on the default RESP3 legacy callback (<a
href="https://redirect.github.com/redis/redis-py/issues/4201 ">#4201</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/599fd75ca7d0745928280ff3a64ccd224dbf2b76 "><code>599fd75</code></a>
feat: add FT.ALIASLIST support (<a
href="https://redirect.github.com/redis/redis-py/issues/4198 ">#4198</a>)</li>
<li><a
href="https://github.com/redis/redis-py/commit/71e275e6eae94d202b49bccce10ef0d2a59050e7 "><code>71e275e</code></a>
test: add VectorField RERANK serialization tests for sync and async
search (#...</li>
<li>Additional commits viewable in <a
href="https://github.com/redis/redis-py/compare/v8.0.1...v8.1.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.15.20 to 0.16.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.1</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-30.</p>
<h3>Preview features</h3>
<ul>
<li>Add an option to opt out of human-readable names (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27160 ">#27160</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make fixes safe by default and
unsafe only when comments are present (<code>PT018</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27201 ">#27201</a>)</li>
<li>[<code>pyupgrade</code>] Skip fix when a defaulted
<code>TypeVar</code> precedes a non-defaulted one (<code>UP040</code>,
<code>UP046</code>, <code>UP047</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27133 ">#27133</a>)</li>
<li>[<code>ruff</code>] Fix false positive with unpacked arguments
(<code>RUF065</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26959 ">#26959</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Bump <code>gen-lsp-types</code> to gracefully handle unknown
enumeration values in LSP messages (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27230 ">#27230</a>)</li>
<li>[<code>flake8-bugbear</code>] Mark <code>range</code> as immutable
(<code>B008</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27247 ">#27247</a>)</li>
<li>[<code>flake8-comprehensions</code>] NFKC-normalize keyword names in
<code>C408</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26813 ">#26813</a>)</li>
<li>[<code>flake8-return</code>] Fix false positive when variable is
read in <code>finally</code> clause (<code>RET504</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25441 ">#25441</a>)</li>
<li>[<code>pydocstyle</code>] Skip section detection inside RST
directive bodies (<code>D214</code>, <code>D405</code>,
<code>D413</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/23635 ">#23635</a>)</li>
<li>[<code>refurb</code>] Parenthesize <code>yield</code> arguments in
the <code>FURB192</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27192 ">#27192</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-pytest-style</code>] Mark <code>PT022</code> fixes as
unsafe (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26440 ">#26440</a>)</li>
<li>[<code>refurb</code>] Mark fixes that remove unknown separators as
unsafe (<code>FURB105</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27200 ">#27200</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix indexing of excluded nested Ruff workspaces (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27303 ">#27303</a>)</li>
<li>Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26862 ">#26862</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Cover <code>pycon</code> Markdown formatting (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27153 ">#27153</a>)</li>
<li>[<code>flake8-bandit</code>] Document <code>TYPE_CHECKING</code>
exception (<code>S101</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27004 ">#27004</a>)</li>
<li>[<code>flake8-import-conventions</code>] Document that
<code>extend-aliases</code> can override default aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27191 ">#27191</a>)</li>
<li>[<code>pylint</code>] Add missing fix safety gotchas for
<code>non-augmented-assignment</code> (<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27250 ">#27250</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Reduce syntax error noise by swallowing dedents like indents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27170 ">#27170</a>)</li>
<li>Vendor latest annotate-snippets (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27033 ">#27033</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/bxff "><code>@bxff</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
<li><a href="https://github.com/Avasam "><code>@Avasam</code></a></li>
<li><a href="https://github.com/epage "><code>@epage</code></a></li>
<li><a href="https://github.com/LHMQ878 "><code>@LHMQ878</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.1</h2>
<p>Released on 2026-07-30.</p>
<h3>Preview features</h3>
<ul>
<li>Add an option to opt out of human-readable names (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27160 ">#27160</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make fixes safe by default and
unsafe only when comments are present (<code>PT018</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27201 ">#27201</a>)</li>
<li>[<code>pyupgrade</code>] Skip fix when a defaulted
<code>TypeVar</code> precedes a non-defaulted one (<code>UP040</code>,
<code>UP046</code>, <code>UP047</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27133 ">#27133</a>)</li>
<li>[<code>ruff</code>] Fix false positive with unpacked arguments
(<code>RUF065</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26959 ">#26959</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Bump <code>gen-lsp-types</code> to gracefully handle unknown
enumeration values in LSP messages (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27230 ">#27230</a>)</li>
<li>[<code>flake8-bugbear</code>] Mark <code>range</code> as immutable
(<code>B008</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27247 ">#27247</a>)</li>
<li>[<code>flake8-comprehensions</code>] NFKC-normalize keyword names in
<code>C408</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26813 ">#26813</a>)</li>
<li>[<code>flake8-return</code>] Fix false positive when variable is
read in <code>finally</code> clause (<code>RET504</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25441 ">#25441</a>)</li>
<li>[<code>pydocstyle</code>] Skip section detection inside RST
directive bodies (<code>D214</code>, <code>D405</code>,
<code>D413</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/23635 ">#23635</a>)</li>
<li>[<code>refurb</code>] Parenthesize <code>yield</code> arguments in
the <code>FURB192</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27192 ">#27192</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-pytest-style</code>] Mark <code>PT022</code> fixes as
unsafe (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26440 ">#26440</a>)</li>
<li>[<code>refurb</code>] Mark fixes that remove unknown separators as
unsafe (<code>FURB105</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27200 ">#27200</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix indexing of excluded nested Ruff workspaces (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27303 ">#27303</a>)</li>
<li>Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26862 ">#26862</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Cover <code>pycon</code> Markdown formatting (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27153 ">#27153</a>)</li>
<li>[<code>flake8-bandit</code>] Document <code>TYPE_CHECKING</code>
exception (<code>S101</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27004 ">#27004</a>)</li>
<li>[<code>flake8-import-conventions</code>] Document that
<code>extend-aliases</code> can override default aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27191 ">#27191</a>)</li>
<li>[<code>pylint</code>] Add missing fix safety gotchas for
<code>non-augmented-assignment</code> (<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27250 ">#27250</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Reduce syntax error noise by swallowing dedents like indents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27170 ">#27170</a>)</li>
<li>Vendor latest annotate-snippets (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27033 ">#27033</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/bxff "><code>@bxff</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
<li><a href="https://github.com/Avasam "><code>@Avasam</code></a></li>
<li><a href="https://github.com/epage "><code>@epage</code></a></li>
<li><a href="https://github.com/LHMQ878 "><code>@LHMQ878</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/80790b348b5188e7fc253665540f442c6ec7dd05 "><code>80790b3</code></a>
Bump 0.16.1 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27330 ">#27330</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/63830f3e97b56ca3be0dd8f1092f76c4acc63213 "><code>63830f3</code></a>
[ty] Borrow from constraint set storage less often (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27328 ">#27328</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/f40dca98a7f1b6fff0cee5ecf1e6364d5a8bdc15 "><code>f40dca9</code></a>
[ty] Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27266 ">#27266</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/0d804975a2645d6e4a795cf501fd764b88aa47e3 "><code>0d80497</code></a>
Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26862 ">#26862</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d91586bd5b30f77f6614d57b73fc7dbea9051a0e "><code>d91586b</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27293 ">#27293</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/7da4b8b8d78fd6df2b3e06d8466d9cd49822900d "><code>7da4b8b</code></a>
[ty] Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27228 ">#27228</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b20daf741241a6829ff8963a203f7847561deb62 "><code>b20daf7</code></a>
[ty] refactor: add helper function to send partial results (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27249 ">#27249</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4d4c8fa1c75b00561ea24eefefb13eb5ff80e01f "><code>4d4c8fa</code></a>
[ty] Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26883 ">#26883</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/7c3e2db97deb5c5edd6e4303403ef6caf2bde8be "><code>7c3e2db</code></a>
[ty] Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27318 ">#27318</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d5ef97fcd03e108f7510f84b8ed85bb4051311fe "><code>d5ef97f</code></a>
[<code>flake8-return</code>] Fix false positive when variable is read in
<code>finally</code> claus...</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.66
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.66</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-03.</p>
<h3>LSP server</h3>
<ul>
<li>Index <code>with</code>-statement targets as symbols (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27256 ">#27256</a>)</li>
<li>Trigger signature help after completing callable with parentheses
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27084 ">#27084</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Pydantic: Recognize models installed on extra search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27429 ">#27429</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Detect <code>__aenter__</code> and <code>__aexit__</code> that do
not return awaitables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27414 ">#27414</a>)</li>
<li>Diagnose dataclass fields after inherited defaults (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27327 ">#27327</a>)</li>
<li>Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26883 ">#26883</a>)</li>
<li>Improve error context for incompatible callable signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27422 ">#27422</a>)</li>
<li>Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27266 ">#27266</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid over-materializing user-defined <code>TypeIs</code> return
types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26864 ">#26864</a>)</li>
<li>Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27318 ">#27318</a>)</li>
<li>Hide stub-only helpers from implicit builtin lookup (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27423 ">#27423</a>)</li>
<li>Move <code>Unknown</code> out of the experimental
<code>ty_extensions</code> API (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27430 ">#27430</a>)</li>
<li>Preserve <code>TypeVarTuple</code> context during
<code>Generic</code> recovery (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27381 ">#27381</a>)</li>
<li>Preserve exact numeric types in covariant collections (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27311 ">#27311</a>)</li>
<li>Reject <code>ClassVar</code> and <code>Final</code> qualifiers in
<code>NamedTuple</code> fields (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27380 ">#27380</a>)</li>
<li>Reject out-of-scope <code>ParamSpec</code> components (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27378 ">#27378</a>)</li>
<li>Reject specializing non-generic subclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27377 ">#27377</a>)</li>
<li>Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27228 ">#27228</a>)</li>
<li>Sync vendored typeshed stubs (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27401 ">#27401</a>).
<a
href="https://github.com/python/typeshed/compare/b00c387c669cb50d5d388d77b74c2e832e147fe8...1b116673774d062a4af7b0a0b3d05533a6be55d0 ">Typeshed
diff</a></li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/dhruvmanila "><code>@dhruvmanila</code></a></li>
<li><a href="https://github.com/carljm "><code>@carljm</code></a></li>
<li><a
href="https://github.com/Punisheroot "><code>@Punisheroot</code></a></li>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a
href="https://github.com/cheparity "><code>@cheparity</code></a></li>
<li><a
href="https://github.com/BitWeaverDev "><code>@BitWeaverDev</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ribru17 "><code>@ribru17</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
</ul>
<h2>Install ty 0.0.66</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.66</h2>
<p>Released on 2026-08-03.</p>
<h3>LSP server</h3>
<ul>
<li>Index <code>with</code>-statement targets as symbols (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27256 ">#27256</a>)</li>
<li>Trigger signature help after completing callable with parentheses
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27084 ">#27084</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Pydantic: Recognize models installed on extra search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27429 ">#27429</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Detect <code>__aenter__</code> and <code>__aexit__</code> that do
not return awaitables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27414 ">#27414</a>)</li>
<li>Diagnose dataclass fields after inherited defaults (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27327 ">#27327</a>)</li>
<li>Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26883 ">#26883</a>)</li>
<li>Improve error context for incompatible callable signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27422 ">#27422</a>)</li>
<li>Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27266 ">#27266</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid over-materializing user-defined <code>TypeIs</code> return
types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26864 ">#26864</a>)</li>
<li>Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27318 ">#27318</a>)</li>
<li>Hide stub-only helpers from implicit builtin lookup (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27423 ">#27423</a>)</li>
<li>Move <code>Unknown</code> out of the experimental
<code>ty_extensions</code> API (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27430 ">#27430</a>)</li>
<li>Preserve <code>TypeVarTuple</code> context during
<code>Generic</code> recovery (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27381 ">#27381</a>)</li>
<li>Preserve exact numeric types in covariant collections (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27311 ">#27311</a>)</li>
<li>Reject <code>ClassVar</code> and <code>Final</code> qualifiers in
<code>NamedTuple</code> fields (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27380 ">#27380</a>)</li>
<li>Reject out-of-scope <code>ParamSpec</code> components (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27378 ">#27378</a>)</li>
<li>Reject specializing non-generic subclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27377 ">#27377</a>)</li>
<li>Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27228 ">#27228</a>)</li>
<li>Sync vendored typeshed stubs (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27401 ">#27401</a>).
<a
href="https://github.com/python/typeshed/compare/b00c387c669cb50d5d388d77b74c2e832e147fe8...1b116673774d062a4af7b0a0b3d05533a6be55d0 ">Typeshed
diff</a></li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/dhruvmanila "><code>@dhruvmanila</code></a></li>
<li><a href="https://github.com/carljm "><code>@carljm</code></a></li>
<li><a
href="https://github.com/Punisheroot "><code>@Punisheroot</code></a></li>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a
href="https://github.com/cheparity "><code>@cheparity</code></a></li>
<li><a
href="https://github.com/BitWeaverDev "><code>@BitWeaverDev</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ribru17 "><code>@ribru17</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
</ul>
<h2>0.0.65</h2>
<p>Released on 2026-07-29.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/3e28e58af75c3b16403c05ab401ae7347b65c5e2 "><code>3e28e58</code></a>
Bump version to 0.0.66 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4166 ">#4166</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/87de836dfef2d3e1990440752e30e24cfb572f4e "><code>87de836</code></a>
Bump version to 0.0.65 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4113 ">#4113</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d784bad352f4640e7f788eac4dfb0353ca199902 "><code>d784bad</code></a>
README: Add link to Stable milestone (<a
href="https://redirect.github.com/astral-sh/ty/issues/4112 ">#4112</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/b4c1978dbdf18501ed03139e33ee8afaef251ec3 "><code>b4c1978</code></a>
Update actions/setup-python action to v7 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4110 ">#4110</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/8d216a39dad99c4443396a08a77da00502cd7e58 "><code>8d216a3</code></a>
Update actions/checkout action to v7.0.1 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4107 ">#4107</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/06f44e9039cb2764346c4bceaff4021ac143de9e "><code>06f44e9</code></a>
Update dependency prek to v0.4.10 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4108 ">#4108</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/b3665fde4804424576a30078bc0b7c101c5e2242 "><code>b3665fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4109 ">#4109</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.66 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `anyio` from 4.14.1 to 4.14.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.14.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-08-08 12:02:52 -07:00
6a2822d3c7
chore(deps): bump the minor-and-patch group across 1 directory with 5 updates ( #8532 )
...
Bumps the minor-and-patch group with 5 updates in the /libs/sdk-py
directory:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.4.8`
| `1.5.3` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.15.20` | `0.16.1` |
| [codespell](https://github.com/codespell-project/codespell ) | `2.4.2`
| `2.4.3` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.55` | `0.0.66` |
| [xxhash](https://github.com/ifduyue/python-xxhash ) | `3.8.0` | `3.8.1`
|
Updates `langchain-core` from 1.4.8 to 1.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.3</h2>
<p>Changes since langchain-core==1.5.2</p>
<p>release(core): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39145 ">#39145</a>)
fix(core): fall back to <code>LANGSMITH_API_KEY</code> for gateway (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39115 ">#39115</a>)</p>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/01d8481ae3d457ec3751cbb0331ea3a4b720fa90 "><code>01d8481</code></a>
release(core): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39145 ">#39145</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b8a6e36d3f810302c66065ea1c2892da000de550 "><code>b8a6e36</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39141 ">#39141</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/cdca311de2958e497cfd823a45ddb770d0ef94c0 "><code>cdca311</code></a>
fix(core): fall back to <code>LANGSMITH_API_KEY</code> for gateway (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39115 ">#39115</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a5a8762436658b218dbfc5efff9e8ab8fabbe62f "><code>a5a8762</code></a>
ci: annotate uv bump workflow with PR links (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39112 ">#39112</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/557c0a986d5068085a945dcb3c9ce27257c4add8 "><code>557c0a9</code></a>
chore(deps): bump uv to 0.12.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39111 ">#39111</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/835c85ae236a2d33cd11de4c98d28cbc6ebbd72f "><code>835c85a</code></a>
release(anthropic): 1.5.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39109 ">#39109</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.15.20 to 0.16.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.1</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-30.</p>
<h3>Preview features</h3>
<ul>
<li>Add an option to opt out of human-readable names (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27160 ">#27160</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make fixes safe by default and
unsafe only when comments are present (<code>PT018</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27201 ">#27201</a>)</li>
<li>[<code>pyupgrade</code>] Skip fix when a defaulted
<code>TypeVar</code> precedes a non-defaulted one (<code>UP040</code>,
<code>UP046</code>, <code>UP047</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27133 ">#27133</a>)</li>
<li>[<code>ruff</code>] Fix false positive with unpacked arguments
(<code>RUF065</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26959 ">#26959</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Bump <code>gen-lsp-types</code> to gracefully handle unknown
enumeration values in LSP messages (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27230 ">#27230</a>)</li>
<li>[<code>flake8-bugbear</code>] Mark <code>range</code> as immutable
(<code>B008</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27247 ">#27247</a>)</li>
<li>[<code>flake8-comprehensions</code>] NFKC-normalize keyword names in
<code>C408</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26813 ">#26813</a>)</li>
<li>[<code>flake8-return</code>] Fix false positive when variable is
read in <code>finally</code> clause (<code>RET504</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25441 ">#25441</a>)</li>
<li>[<code>pydocstyle</code>] Skip section detection inside RST
directive bodies (<code>D214</code>, <code>D405</code>,
<code>D413</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/23635 ">#23635</a>)</li>
<li>[<code>refurb</code>] Parenthesize <code>yield</code> arguments in
the <code>FURB192</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27192 ">#27192</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-pytest-style</code>] Mark <code>PT022</code> fixes as
unsafe (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26440 ">#26440</a>)</li>
<li>[<code>refurb</code>] Mark fixes that remove unknown separators as
unsafe (<code>FURB105</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27200 ">#27200</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix indexing of excluded nested Ruff workspaces (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27303 ">#27303</a>)</li>
<li>Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26862 ">#26862</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Cover <code>pycon</code> Markdown formatting (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27153 ">#27153</a>)</li>
<li>[<code>flake8-bandit</code>] Document <code>TYPE_CHECKING</code>
exception (<code>S101</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27004 ">#27004</a>)</li>
<li>[<code>flake8-import-conventions</code>] Document that
<code>extend-aliases</code> can override default aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27191 ">#27191</a>)</li>
<li>[<code>pylint</code>] Add missing fix safety gotchas for
<code>non-augmented-assignment</code> (<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27250 ">#27250</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Reduce syntax error noise by swallowing dedents like indents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27170 ">#27170</a>)</li>
<li>Vendor latest annotate-snippets (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27033 ">#27033</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/bxff "><code>@bxff</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
<li><a href="https://github.com/Avasam "><code>@Avasam</code></a></li>
<li><a href="https://github.com/epage "><code>@epage</code></a></li>
<li><a href="https://github.com/LHMQ878 "><code>@LHMQ878</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.1</h2>
<p>Released on 2026-07-30.</p>
<h3>Preview features</h3>
<ul>
<li>Add an option to opt out of human-readable names (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27160 ">#27160</a>)</li>
<li>[<code>flake8-pytest-style</code>] Make fixes safe by default and
unsafe only when comments are present (<code>PT018</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27201 ">#27201</a>)</li>
<li>[<code>pyupgrade</code>] Skip fix when a defaulted
<code>TypeVar</code> precedes a non-defaulted one (<code>UP040</code>,
<code>UP046</code>, <code>UP047</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27133 ">#27133</a>)</li>
<li>[<code>ruff</code>] Fix false positive with unpacked arguments
(<code>RUF065</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26959 ">#26959</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Bump <code>gen-lsp-types</code> to gracefully handle unknown
enumeration values in LSP messages (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27230 ">#27230</a>)</li>
<li>[<code>flake8-bugbear</code>] Mark <code>range</code> as immutable
(<code>B008</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27247 ">#27247</a>)</li>
<li>[<code>flake8-comprehensions</code>] NFKC-normalize keyword names in
<code>C408</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26813 ">#26813</a>)</li>
<li>[<code>flake8-return</code>] Fix false positive when variable is
read in <code>finally</code> clause (<code>RET504</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25441 ">#25441</a>)</li>
<li>[<code>pydocstyle</code>] Skip section detection inside RST
directive bodies (<code>D214</code>, <code>D405</code>,
<code>D413</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/23635 ">#23635</a>)</li>
<li>[<code>refurb</code>] Parenthesize <code>yield</code> arguments in
the <code>FURB192</code> fix (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27192 ">#27192</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>flake8-pytest-style</code>] Mark <code>PT022</code> fixes as
unsafe (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26440 ">#26440</a>)</li>
<li>[<code>refurb</code>] Mark fixes that remove unknown separators as
unsafe (<code>FURB105</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27200 ">#27200</a>)</li>
</ul>
<h3>Server</h3>
<ul>
<li>Fix indexing of excluded nested Ruff workspaces (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27303 ">#27303</a>)</li>
<li>Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26862 ">#26862</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Cover <code>pycon</code> Markdown formatting (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27153 ">#27153</a>)</li>
<li>[<code>flake8-bandit</code>] Document <code>TYPE_CHECKING</code>
exception (<code>S101</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27004 ">#27004</a>)</li>
<li>[<code>flake8-import-conventions</code>] Document that
<code>extend-aliases</code> can override default aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27191 ">#27191</a>)</li>
<li>[<code>pylint</code>] Add missing fix safety gotchas for
<code>non-augmented-assignment</code> (<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27250 ">#27250</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Reduce syntax error noise by swallowing dedents like indents (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27170 ">#27170</a>)</li>
<li>Vendor latest annotate-snippets (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27033 ">#27033</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/bxff "><code>@bxff</code></a></li>
<li><a
href="https://github.com/anishgirianish "><code>@anishgirianish</code></a></li>
<li><a href="https://github.com/Avasam "><code>@Avasam</code></a></li>
<li><a href="https://github.com/epage "><code>@epage</code></a></li>
<li><a href="https://github.com/LHMQ878 "><code>@LHMQ878</code></a></li>
<li><a
href="https://github.com/MichaReiser "><code>@MichaReiser</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/80790b348b5188e7fc253665540f442c6ec7dd05 "><code>80790b3</code></a>
Bump 0.16.1 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27330 ">#27330</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/63830f3e97b56ca3be0dd8f1092f76c4acc63213 "><code>63830f3</code></a>
[ty] Borrow from constraint set storage less often (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27328 ">#27328</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/f40dca98a7f1b6fff0cee5ecf1e6364d5a8bdc15 "><code>f40dca9</code></a>
[ty] Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27266 ">#27266</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/0d804975a2645d6e4a795cf501fd764b88aa47e3 "><code>0d80497</code></a>
Lint TOML files in the LSP (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26862 ">#26862</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d91586bd5b30f77f6614d57b73fc7dbea9051a0e "><code>d91586b</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27293 ">#27293</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/7da4b8b8d78fd6df2b3e06d8466d9cd49822900d "><code>7da4b8b</code></a>
[ty] Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27228 ">#27228</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b20daf741241a6829ff8963a203f7847561deb62 "><code>b20daf7</code></a>
[ty] refactor: add helper function to send partial results (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27249 ">#27249</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4d4c8fa1c75b00561ea24eefefb13eb5ff80e01f "><code>4d4c8fa</code></a>
[ty] Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26883 ">#26883</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/7c3e2db97deb5c5edd6e4303403ef6caf2bde8be "><code>7c3e2db</code></a>
[ty] Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27318 ">#27318</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/d5ef97fcd03e108f7510f84b8ed85bb4051311fe "><code>d5ef97f</code></a>
[<code>flake8-return</code>] Fix false positive when variable is read in
<code>finally</code> claus...</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.66
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.66</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-03.</p>
<h3>LSP server</h3>
<ul>
<li>Index <code>with</code>-statement targets as symbols (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27256 ">#27256</a>)</li>
<li>Trigger signature help after completing callable with parentheses
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27084 ">#27084</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Pydantic: Recognize models installed on extra search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27429 ">#27429</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Detect <code>__aenter__</code> and <code>__aexit__</code> that do
not return awaitables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27414 ">#27414</a>)</li>
<li>Diagnose dataclass fields after inherited defaults (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27327 ">#27327</a>)</li>
<li>Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26883 ">#26883</a>)</li>
<li>Improve error context for incompatible callable signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27422 ">#27422</a>)</li>
<li>Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27266 ">#27266</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid over-materializing user-defined <code>TypeIs</code> return
types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26864 ">#26864</a>)</li>
<li>Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27318 ">#27318</a>)</li>
<li>Hide stub-only helpers from implicit builtin lookup (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27423 ">#27423</a>)</li>
<li>Move <code>Unknown</code> out of the experimental
<code>ty_extensions</code> API (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27430 ">#27430</a>)</li>
<li>Preserve <code>TypeVarTuple</code> context during
<code>Generic</code> recovery (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27381 ">#27381</a>)</li>
<li>Preserve exact numeric types in covariant collections (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27311 ">#27311</a>)</li>
<li>Reject <code>ClassVar</code> and <code>Final</code> qualifiers in
<code>NamedTuple</code> fields (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27380 ">#27380</a>)</li>
<li>Reject out-of-scope <code>ParamSpec</code> components (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27378 ">#27378</a>)</li>
<li>Reject specializing non-generic subclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27377 ">#27377</a>)</li>
<li>Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27228 ">#27228</a>)</li>
<li>Sync vendored typeshed stubs (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27401 ">#27401</a>).
<a
href="https://github.com/python/typeshed/compare/b00c387c669cb50d5d388d77b74c2e832e147fe8...1b116673774d062a4af7b0a0b3d05533a6be55d0 ">Typeshed
diff</a></li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/dhruvmanila "><code>@dhruvmanila</code></a></li>
<li><a href="https://github.com/carljm "><code>@carljm</code></a></li>
<li><a
href="https://github.com/Punisheroot "><code>@Punisheroot</code></a></li>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a
href="https://github.com/cheparity "><code>@cheparity</code></a></li>
<li><a
href="https://github.com/BitWeaverDev "><code>@BitWeaverDev</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ribru17 "><code>@ribru17</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
</ul>
<h2>Install ty 0.0.66</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.66</h2>
<p>Released on 2026-08-03.</p>
<h3>LSP server</h3>
<ul>
<li>Index <code>with</code>-statement targets as symbols (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27256 ">#27256</a>)</li>
<li>Trigger signature help after completing callable with parentheses
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27084 ">#27084</a>)</li>
</ul>
<h3>Library support</h3>
<ul>
<li>Pydantic: Recognize models installed on extra search paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27429 ">#27429</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Detect <code>__aenter__</code> and <code>__aexit__</code> that do
not return awaitables (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27414 ">#27414</a>)</li>
<li>Diagnose dataclass fields after inherited defaults (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27327 ">#27327</a>)</li>
<li>Emit diagnostic when specializing a non-generic class (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26883 ">#26883</a>)</li>
<li>Improve error context for incompatible callable signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27422 ">#27422</a>)</li>
<li>Preserve forwarded expanded-variadic diagnostic sources (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27266 ">#27266</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Avoid over-materializing user-defined <code>TypeIs</code> return
types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26864 ">#26864</a>)</li>
<li>Fix enum class container assignability (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27318 ">#27318</a>)</li>
<li>Hide stub-only helpers from implicit builtin lookup (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27423 ">#27423</a>)</li>
<li>Move <code>Unknown</code> out of the experimental
<code>ty_extensions</code> API (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27430 ">#27430</a>)</li>
<li>Preserve <code>TypeVarTuple</code> context during
<code>Generic</code> recovery (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27381 ">#27381</a>)</li>
<li>Preserve exact numeric types in covariant collections (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27311 ">#27311</a>)</li>
<li>Reject <code>ClassVar</code> and <code>Final</code> qualifiers in
<code>NamedTuple</code> fields (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27380 ">#27380</a>)</li>
<li>Reject out-of-scope <code>ParamSpec</code> components (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27378 ">#27378</a>)</li>
<li>Reject specializing non-generic subclasses (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27377 ">#27377</a>)</li>
<li>Respect bounds and constraints in generic materializations (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27228 ">#27228</a>)</li>
<li>Sync vendored typeshed stubs (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27401 ">#27401</a>).
<a
href="https://github.com/python/typeshed/compare/b00c387c669cb50d5d388d77b74c2e832e147fe8...1b116673774d062a4af7b0a0b3d05533a6be55d0 ">Typeshed
diff</a></li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/dhruvmanila "><code>@dhruvmanila</code></a></li>
<li><a href="https://github.com/carljm "><code>@carljm</code></a></li>
<li><a
href="https://github.com/Punisheroot "><code>@Punisheroot</code></a></li>
<li><a
href="https://github.com/AlexWaygood "><code>@AlexWaygood</code></a></li>
<li><a
href="https://github.com/cheparity "><code>@cheparity</code></a></li>
<li><a
href="https://github.com/BitWeaverDev "><code>@BitWeaverDev</code></a></li>
<li><a
href="https://github.com/charliermarsh "><code>@charliermarsh</code></a></li>
<li><a href="https://github.com/ribru17 "><code>@ribru17</code></a></li>
<li><a href="https://github.com/sharkdp "><code>@sharkdp</code></a></li>
</ul>
<h2>0.0.65</h2>
<p>Released on 2026-07-29.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/3e28e58af75c3b16403c05ab401ae7347b65c5e2 "><code>3e28e58</code></a>
Bump version to 0.0.66 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4166 ">#4166</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/87de836dfef2d3e1990440752e30e24cfb572f4e "><code>87de836</code></a>
Bump version to 0.0.65 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4113 ">#4113</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/d784bad352f4640e7f788eac4dfb0353ca199902 "><code>d784bad</code></a>
README: Add link to Stable milestone (<a
href="https://redirect.github.com/astral-sh/ty/issues/4112 ">#4112</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/b4c1978dbdf18501ed03139e33ee8afaef251ec3 "><code>b4c1978</code></a>
Update actions/setup-python action to v7 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4110 ">#4110</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/8d216a39dad99c4443396a08a77da00502cd7e58 "><code>8d216a3</code></a>
Update actions/checkout action to v7.0.1 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4107 ">#4107</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/06f44e9039cb2764346c4bceaff4021ac143de9e "><code>06f44e9</code></a>
Update dependency prek to v0.4.10 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4108 ">#4108</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/b3665fde4804424576a30078bc0b7c101c5e2242 "><code>b3665fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4109 ">#4109</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.66 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `xxhash` from 3.8.0 to 3.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/releases ">xxhash's
releases</a>.</em></p>
<blockquote>
<h2>v3.8.1</h2>
<ul>
<li>Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning</li>
<li>Update C extension docstrings and remove stale comments</li>
</ul>
<hr />
<p>Full list of changes: <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst ">xxhash's
changelog</a>.</em></p>
<blockquote>
<p>v3.8.1 2026-07-06</p>
<pre><code>
- Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning
- Update C extension docstrings and remove stale comments
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/0a1adf7b6a5f26b821272985a0a987cca5446c23 "><code>0a1adf7</code></a>
Release v3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa419ca1478219b7ba2ad18a8fe05ca9d29288bc "><code>aa419ca</code></a>
Prepare 3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/e26b770f19b5eabd1c58d098206e5c9adfcef5d1 "><code>e26b770</code></a>
docs: update C extension docstrings and remove stale comments</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa69707513c4ba8c52a4bebc23f0aada7844decc "><code>aa69707</code></a>
Register the “benchmark” pytest mark</li>
<li>See full diff in <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com >
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com >
2026-08-08 12:01:48 -07:00
Elior Nataf Lackritz
fde3068970
release(checkpoint-postgres): 3.1.2 ( #8565 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpointpostgres==3.1.1`:
- #8535 - find plain-value seeds when walking delta history
Follows `checkpoint==4.2.0`, which is already live on PyPI. No
dependency change needed here, since
`langgraph-checkpoint>=4.1.0,<5.0.0` already admits 4.2.0.
2026-08-07 16:32:21 -04:00
Elior Nataf Lackritz
f55e77274d
release(checkpoint): 4.2.0 ( #8563 )
...
Version bump only. No library code changes in this PR.
Unreleased since `checkpoint==4.1.1`:
- #8526 - collect writes at plain-value seed in delta channel history
- #8354 - add opt-in `TTLConfig.omit_expired` to skip expired rows on
read
Minor rather than patch because #8354 adds a new public `TTLConfig` key.
Note that the checkpoint-postgres half of #8354 already shipped in
`checkpointpostgres==3.1.1`, so the currently released Postgres saver
honors an option that no released `langgraph-checkpoint` declares. This
closes that gap.
`langgraph-checkpoint-postgres` 3.1.2 (#8535 ) follows once this is live
on PyPI.
2026-08-07 15:59:52 -04:00
Elior Nataf Lackritz and PiedPiper911
a90ab44358
fix(checkpoint): collect writes at plain-value seed in delta channel history ( #8526 )
...
Fixes langchain-ai/langgraph#8384
`InMemorySaver.get_delta_channel_history` skipped the writes stored at
the ancestor it seeded from whenever that ancestor's blob was a plain
value rather than a `_DeltaSnapshot`, silently dropping the first write
made after migrating a thread to `DeltaChannel`.
### Why the old rule was wrong
A stored blob is the value *entering* its checkpoint; the writes stored
under that same checkpoint are what produce its child. That's true for
`_DeltaSnapshot` blobs and pre-delta plain values alike, so there was
never a reason to treat them differently.
Writes at ancestors *older* than the seed genuinely are subsumed by the
seed value — but that's already guaranteed by terminating the walk,
since the channel leaves `remaining` once its seed is found. The removed
check re-solved that and overreached by one checkpoint.
`BaseCheckpointSaver`, `SqliteSaver` and `PostgresSaver` never had this
check. `InMemorySaver` was the only outlier.
### How I verified it
Built a differential harness running the same migration scenarios
through `InMemorySaver`, the `BaseCheckpointSaver` reference walk, and
`SqliteSaver`. **4 of 11 scenarios agreed before this change; 11 of 11
after.** The loss is wider than one write — on the `add_messages` →
`DeltaChannel` path it drops a real user message.
Suites: `libs/checkpoint` 156 passed, `libs/langgraph` 1972 passed,
`libs/checkpoint-sqlite` 117 passed, `libs/checkpoint-postgres` passed
against PG 16. `make format`, `make lint` clean in each.
### Two things worth a closer look in review
**1. I inverted two existing assertions** in
`TestPreDeltaBlobTerminator` (`libs/checkpoint/tests/test_memory.py`).
They encoded the old rule. Their fixture is the real migration shape — a
plain-value blob carrying pending writes, with a delta-era child — which
I confirmed against a dumped checkpoint chain from the issue's repro, so
the assertions were wrong rather than the fixture being unrealistic. I
added an ancestor *older* than the seed so the terminator still guards
what it legitimately should: older writes stay excluded, the seed's own
writes replay.
**2. The new conformance test fails against Postgres**, for a reason
unrelated to this change. Postgres `aput` leaves an inline `True` marker
in `channel_values` only for `_DeltaSnapshot`; plain non-primitive
values are popped with no marker, and seed detection is `(checkpoint ->
'channel_values' -> ch) IS NOT NULL`. So Postgres can't locate a
plain-value seed at all:
```
seed stored as plain list: InMemorySaver -> [10, 20] AsyncPostgresSaver -> no seed key
seed stored as _DeltaSnapshot: InMemorySaver -> found AsyncPostgresSaver -> found
```
The pre-existing `test_history_migration_plain_value_as_seed` already
fails there too — conformance CI only validates `InMemorySaver`, so
nobody was watching. Values still come out correct today (with no seed
the walk runs to the root and replays everything), but early termination
is lost: 1 write replayed on `InMemorySaver` vs 7 on Postgres for the
same 6-turn thread. Filing separately rather than folding a
write-path/format decision into this PR.
### Note on scope
This touches three packages: the fix in `libs/checkpoint`, graph-level
regression tests in `libs/langgraph` (the bug is only observable through
a graph read), and the contract test in `libs/checkpoint-conformance` so
third-party savers are covered too.
---------
Co-authored-by: PiedPiper911 <32931126+PiedPiper911@users.noreply.github.com >
2026-08-07 12:29:41 -04:00
Elior Nataf Lackritz
ea5f9cc9fb
chore: enforce PLC0415 in tests for the remaining packages ( #8547 )
...
Follow-up to #8540 , which turned on `PLC0415` (import-outside-top-level)
for checkpoint-postgres and checkpoint-sqlite. This does the remaining
six packages: checkpoint, checkpoint-conformance, langgraph, prebuilt,
cli, sdk-py.
Scoped to tests, per @sydney-runkle's call on #8540 : library code is
exempted with `per-file-ignores`, since it still has deferred imports
nobody has reviewed and mixing that in would make this hard to read.
## What changed
Function-level imports across 56 test files moved to module level. Nine
could not move and carry an explicit `# noqa: PLC0415` with a reason:
| File | Why it stays local |
|---|---|
| `libs/langgraph/tests/test_deprecation.py` (4) | the import has to run
inside `pytest.warns` for the warning to be observed |
| `libs/langgraph/tests/test_serde_allowlist.py` | try/except guard,
skips when langchain_core is absent |
| `libs/langgraph/tests/test_delta_channel_benchmark.py` | optional
psycopg probe |
| `libs/checkpoint/tests/test_conformance_delta.py` (3) | protected by a
module-level `pytest.importorskip`; hoisting past the guard turns a skip
into a collection error |
That last one is the trap: an import moved above `pytest.importorskip`
silently defeats the guard. I hit it locally and it turned the skip into
a `ModuleNotFoundError` at collection. Every file with an `importorskip`
or `except ImportError` was checked by hand for this.
## Verification
`make lint` and `make test` in each of the six:
| Package | Tests |
|---|---|
| checkpoint | 156 passed, 17 skipped |
| checkpoint-conformance | 1 passed |
| langgraph | 1968 passed, 4 skipped |
| prebuilt | 284 passed |
| cli | 336 passed |
| sdk-py | 493 passed |
Also confirmed the rule actually fires: a throwaway test file with a
function-level import is flagged in all six packages, and the source
exemption holds.
2026-08-07 09:40:18 -04:00
Elior Nataf Lackritz
36a505ac65
test(checkpoint-postgres,checkpoint-sqlite): run the conformance suite ( #8537 )
...
Depends on #8535
`libs/checkpoint-conformance/tests/` only validates `InMemorySaver`.
`checkpoint-sqlite` has had a `test_conformance_delta.py` for a while,
but it guards on `importorskip("langgraph.checkpoint.conformance")` and
the package was never in its test environment — so it has been skipping
silently every run. `checkpoint-postgres` had no runner at all.
Net effect: the shared checkpointer contract was effectively unenforced
everywhere except in-memory.
### Change
Adds `langgraph-checkpoint-conformance` to the `test` dependency group
of both packages, with a path source like the existing
`langgraph-checkpoint` entry. That alone is what makes sqlite's runner
start executing. Postgres gets the equivalent runner.
Both pass the `delta_channel_history` capability.
### Why it's stacked
Against `main`'s Postgres, the new runner fails:
```
Capability delta_channel_history failed:
test_history_migration_plain_value_as_seed
```
That is exactly the bug #8535 fixes, and it had been failing unnoticed
precisely because nothing ran the suite there. So this is based on that
branch rather than `main` — the diff here is the one conformance commit,
and it will retarget once #8535 lands.
Reasonable to read that as the change justifying itself: the first thing
turning the suite on did was catch a real bug that had been sitting in
`main`.
### Verified
`checkpoint-postgres` 270 passed on PG 15 and 16, `checkpoint-sqlite`
118 passed, lint and `ty` clean in both. The `uv.lock` updates are the
conformance package entry only.
### Note
The sync `PostgresSaver` and `SqliteSaver` aren't covered — the
conformance harness reports every capability as `detected=False` for
them, so only the async savers are exercised. Pre-existing and not
addressed here, but worth knowing the coverage isn't total.
2026-08-07 09:39:20 -04:00
Elior Nataf Lackritz
d569e18f4b
fix(checkpoint-postgres): find plain-value seeds when walking delta history ( #8535 )
...
Fixes langchain-ai/langgraph#8534
`put` splits stored values in two: primitives stay inline in the
checkpoint's `channel_values`, everything else moves to
`checkpoint_blobs`, and only `_DeltaSnapshot` leaves an inline marker
behind when it moves. Stage-1 seed detection tested for that marker, so
a plain value — what a thread migrated from `BinaryOperatorAggregate`
leaves behind — was invisible to the walk.
### Effect
Migrated threads found no seed, walked to the root, and replayed every
write on every read. Values still came out correct, because replaying an
additive reducer from empty rebuilds the same list, which is why nothing
looked wrong. What was lost is early termination — the entire point of
`DeltaChannel`:
<!-- linear:table-colwidths:266,266,266 -->
| thread length | writes replayed, before | after |
| -- | -- | -- |
| 2 turns | 3 | 1 |
| 6 turns | 7 | 1 |
| 20 turns | 21 | 1 |
Read latency is flat at \~0.6ms across all three after the change.
### Approach
Stage 1 now checks both places a value can live rather than trusting the
marker. It probes `checkpoint_blobs`:
```sql
EXISTS (SELECT 1 FROM checkpoint_blobs b0
WHERE b0.thread_id = checkpoints.thread_id
AND b0.checkpoint_ns = checkpoints.checkpoint_ns
AND b0.channel = %s
AND b0.version = checkpoint -> 'channel_versions' ->> %s
AND b0.type <> 'empty') AS hb_0
```
and selects the inline value alongside it, since `None`, `str`, `int`,
`float` and `bool` stay in `channel_values` with no blob row:
```sql
checkpoint -> 'channel_values' -> %s AS inline_0
```
The blob predicate matches `checkpoint_blobs`' primary key `(thread_id,
checkpoint_ns, channel, version)` exactly, so it is one index lookup per
row per channel, bounded by the 1024-row page.
I picked reading storage over the cheaper alternative — also writing the
marker for plain values — because **that would not fix any thread
already on disk.** Existing checkpoints have no marker and there is
nowhere to add one retroactively.
The seed resolves to the blob when one exists and the inline value
otherwise. That ordering is also what keeps a genuine inline `true` — a
`bool` channel holding `True` — distinguishable from the literal `true`
marker `put` inlines for a `_DeltaSnapshot`: only the snapshot has a
blob.
`None` is deliberately not treated as a seed; a JSON null is
indistinguishable from "nothing stored" at this layer, so the walk
continues and replay from empty is correct.
Params go from two to four per channel; both callers updated.
The inline half came out of review on this PR — a blob-only probe would
have left scalar-aggregate migrations (an integer sum, say) still
replaying their full history.
### On the `type <> 'empty'` predicate
Being upfront since it isn't demonstrable with a test: `put` does not
currently produce `empty` rows on this path — `blob_versions` is
filtered to keys present in `channel_values`, so `_dump_blobs`' empty
branch is unreachable from it. I confirmed there are no `empty` rows in
a populated test database.
I kept it because stage 2 already applies the same check when resolving
the seed blob. Without it the two stages could disagree: stage 1
terminates the walk on a row stage 2 then discards, producing no seed
*and* a truncated write chain — the same failure shape this function
exists to avoid. Rationale is in the docstring so the next reader
doesn't have to ask. Happy to drop it if you'd rather not carry an
unexercised predicate.
### Tests
`libs/checkpoint-postgres/tests/test_delta_plain_value_seed.py` —
blob-stored plain-value seed, `_DeltaSnapshot` seed, a version bump with
nothing stored (which must not stop the walk short of an older real
value), inline primitives (`int`, `str`, `float`, `None`), and inline
`True` versus the snapshot marker. Each fails against the behaviour it
fixes.
Verified: postgres suite 269 passed on PG 15 and 16; delta-channel
conformance against `AsyncPostgresSaver` went from 6 of 8 to 8 of 8,
including the pre-existing `test_history_migration_plain_value_as_seed`
failure this was causing; `make lint` clean.
### Not included
I wanted a Postgres conformance runner alongside `checkpoint-sqlite`'s,
but it needs `langgraph-checkpoint-conformance` as a dev dependency and
the contributing guide asks for maintainer sign-off before adding one.
The direct tests above cover the same ground without it.
Worth flagging separately: **conformance effectively runs against**
`InMemorySaver` **only today.** `libs/checkpoint-conformance/tests/`
contains just `test_validate_memory.py`, and `checkpoint-sqlite`'s
`test_conformance_delta.py` silently skips because the package isn't
installed in its test environment (`importorskip`). Wiring it up for
sqlite and postgres is what would have caught this bug, and
langchain-ai/langgraph#8534 notes it.
Sqlite is unaffected by the bug itself — it stores `channel_values`
inline and inspects them directly. `langgraph-api` already resolves
seeds by version rather than by marker.
2026-08-07 09:07:04 -04:00
Elior Nataf Lackritz
f22af6248c
chore: enable RUF100 and clear unused noqa directives ( #8546 )
...
Follow-up to review on #8540 , where a stale `# noqa: E402` slipped past
me and Sydney spotted it by eye. This turns on the rule that catches
that automatically.
`RUF100` flags a `noqa` that suppresses nothing. `sdk-py` already had it
through its blanket `RUF` selection; this adds it to the other seven
packages and clears what it finds.
### The 33 it flags, all autofixed
**Blanket `# noqa` on docstring-closing lines** (4, in
`checkpoint-postgres` and `checkpoint-sqlite`). `E501` is in
`lint.ignore` for those packages, so nothing was being suppressed:
```diff
- """ # noqa
+ """
```
**`# noqa: F821` on `anext(aiter_)`** (2). Left over from Python 3.9
support. `anext` became a builtin in 3.10, which is the floor now, so
`F821` no longer fires:
```diff
- anext(aiter_), # type: ignore[arg-type] # noqa: F821
+ anext(aiter_), # type: ignore[arg-type]
```
**Suppressions naming rules the package does not enable** (27), across
`langgraph`, `prebuilt` and `checkpoint-sqlite`: `FBT001`, `FBT002`,
`TC002`, `BLE001`, `ANN001`, `ANN002`, `ANN003`, `E501`, `F401`. Mostly
copied between packages whose rule sets differ.
### One measurement note
If you check these numbers yourself, use `--extend-select`:
```
ruff check --select RUF100 . # 81, misleading
ruff check --extend-select RUF100 . # 33, real
```
With a bare `--select`, ruff treats every other rule as disabled, so
every suppression for another rule looks unused. I quoted 81 before
catching that.
### Verified
`checkpoint-sqlite` 118 passed, `prebuilt` 284 passed, `langgraph` 1968
passed, `checkpoint-postgres` 264 passed on PG 15 and 16. `make lint`
clean in every package.
Independent of #8540 and #8537 , so it can land in any order.
2026-08-06 17:38:31 -04:00
Elior Nataf Lackritz
658541c496
chore(checkpoint-postgres,checkpoint-sqlite): enable PLC0415 lint rule ( #8540 )
...
Follow-up to review on #8537 : turn on ruff's `PLC0415`
(`import-outside-top-level`) so deferred imports in tests stop
accumulating.
Scoped to `checkpoint-postgres` and `checkpoint-sqlite` rather than
repo-wide, because the sweep turns up three different things and only
one of them is a style problem.
### What the rule finds today
```
package tests src files
checkpoint 13 10 11
checkpoint-conformance 0 10 4
checkpoint-postgres 6 0 2
checkpoint-sqlite 9 0 3
langgraph 130 23 32
prebuilt 14 3 7
cli 9 14 10
sdk-py 189 23 38
────────────────────
370 83 107
```
453 violations across 107 files, and ruff has no autofix for this rule.
### Three categories, not one
**Style — hoist.** `checkpoint-sqlite/tests/test_store.py` deferred
`math`, `random`, `time`, `Counter` and `defaultdict` inside methods for
no reason.
**Deliberate — keep, annotate.**
`checkpoint-postgres/tests/test_async.py` defers behind
`pytest.importorskip("langgraph.channels.delta")` because langgraph core
is *not* a test dependency of that package. Hoisting would break the
skip. Those get `# noqa: PLC0415` and a comment.
**Redundant guard — hoist.**
`checkpoint-sqlite/tests/test_conformance_delta.py` deferred imports
only to get past its own `importorskip`. Imports move up; the
`aiosqlite` guard stays, since that dependency genuinely can be absent.
The second category is why I did not enable this everywhere in one go.
Most of the 83 source-level violations look like the same pattern —
optional-dependency handling and circular-import avoidance in
`jsonplus.py`, `embed.py`, `encrypted.py` and friends. Blanket-enabling
would mean `# noqa` on a lot of correct code, and each one wants an
owner's eye rather than a mechanical pass.
These two packages are clean to enforce today because both have **zero**
source-level violations.
### Suggested rollout for the rest
Either extend package by package as owners confirm which deferrals are
intentional, or enable everywhere at once with `per-file-ignores`
grandfathering the current 107 files so new code is blocked immediately
and the debt burns down. Happy to do either — the second is a smaller
diff but leaves a long ignore list.
### Verified
`checkpoint-sqlite` 118 passed, `checkpoint-postgres` 264 passed on PG
15 and 16, `make lint` clean in both.
One overlap worth flagging:
`checkpoint-sqlite/tests/test_conformance_delta.py` is also touched by
#8537 . The change is identical in both, so it should merge cleanly
either way.
2026-08-05 21:23:28 -04:00
dependabot[bot]
fb3d5f0399
chore(deps): bump the minor-and-patch group in /libs/cli/js-examples with 8 updates ( #8492 )
...
Bumps the minor-and-patch group in /libs/cli/js-examples with 8 updates:
| Package | From | To |
| --- | --- | --- |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.1` | `1.2.3` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.7` | `1.4.8` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc ) | `3.3.5` |
`3.3.6` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.62.1` | `8.65.0` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.62.1` | `8.65.0` |
| [eslint](https://github.com/eslint/eslint ) | `10.6.0` | `10.8.0` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.4` | `3.9.6` |
| [ts-jest](https://github.com/kulshekhar/ts-jest ) | `29.4.11` |
`29.4.12` |
Updates `@langchain/core` from 1.2.1 to 1.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11200 ">#11200</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/08e588865927c3bf0eb2ec418cfb3fba527e14bb "><code>08e5888</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(aws): normalize and safely replay Bedrock reasoning blocks</p>
<p>Emit standard reasoning blocks with preserved signatures, omit
incomplete signature-only reasoning during replay, and retain
compatibility with legacy and redacted Bedrock reasoning.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11171 ">#11171</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/82bef01ad3dd5e0317e48da40707be6bccc52f94 "><code>82bef01</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(core): coerce string v1 AIMessage content to text blocks</p>
<p>Prevent <code>contentBlocks.push is not a function</code> when
constructing an
<code>AIMessage</code> with <code>response_metadata.output_version ===
"v1"</code> and string
<code>content</code> (common in serialized LangGraph stream
payloads).</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/82a6b8ebf1a876b0ac819f2ee0ae6c6582031cb5 "><code>82a6b8e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11202 ">#11202</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/08e588865927c3bf0eb2ec418cfb3fba527e14bb "><code>08e5888</code></a>
fix(aws): normalize Bedrock reasoning blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11200 ">#11200</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/21aaeb0b2ea5f526702bf6b8f7e1f6da34a21d2e "><code>21aaeb0</code></a>
fix: patch 13 high/critical Dependabot alerts (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11199 ">#11199</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/782c7f2b2b5c67352736686c8d124e5f85e97fd0 "><code>782c7f2</code></a>
chore(dev): bump <code>@types/node</code> from 25.9.1 to 26.1.0 in the
types group across ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f51f338cf4dd3ba188b048b3bfa8134e9b9a64cf "><code>f51f338</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11176 ">#11176</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/09e7f6d3408323fee5e19fc9af277114b1e8c89d "><code>09e7f6d</code></a>
fix(openai): drop <code>tool_call</code> content blocks from chat
completions input (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11 ">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a9f123a49c1c50fd32d54fe4cb15963d21252d5d "><code>a9f123a</code></a>
fix(openai): filter out content blocks the chat completions api rejects
as in...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/cc39f564a9df18655ee4ae92de3f32e251021db8 "><code>cc39f56</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11172 ">#11172</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/82bef01ad3dd5e0317e48da40707be6bccc52f94 "><code>82bef01</code></a>
fix(core): coerce string v1 AIMessage content to text blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11171 ">#11171</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8a7c5f83e570c615c6b34e1234f5972dc7a2169c "><code>8a7c5f8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11170 ">#11170</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.1...@langchain/core@1.2.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.7 to 1.4.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2604 ">#2604</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(pregel): wait for completed-superstep persistence with sync
durability</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f326b89365043bfa846e0b428564bcafafab4aaa "><code>f326b89</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/c201256b27d55c9aa333d3d15f6ec16c2fd7de9b "><code>c201256</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.26</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2604 ">#2604</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(pregel): wait for completed-superstep persistence with sync
durability</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f326b89365043bfa846e0b428564bcafafab4aaa "><code>f326b89</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/c201256b27d55c9aa333d3d15f6ec16c2fd7de9b "><code>c201256</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.26</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3dccad1391e173eead64f9e2d6dd977fdc345f7d "><code>3dccad1</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2603 ">#2603</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
fix(core): enforce sync durability barriers (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2604 ">#2604</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/644892c7db89d1c58e4928c156af3b662b85e443 "><code>644892c</code></a>
docs(langgraph): fix README logo paths (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2599 ">#2599</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/8fb6376a75c4e868fd688578e17780148132716b "><code>8fb6376</code></a>
chore: update Vitest to 4.1.9 (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2587 ">#2587</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/81f63653d388514ea71c3a6978718a8ae31278db "><code>81f6365</code></a>
chore(deps): bump the langchain group with 8 updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2578 ">#2578</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.8/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@eslint/eslintrc` from 3.3.5 to 3.3.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/releases ">@eslint/eslintrc's
releases</a>.</em></p>
<blockquote>
<h2>eslintrc: v3.3.6</h2>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">3.3.6</a>
(2026-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc ">0c5de74</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md ">@eslint/eslintrc's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">3.3.6</a>
(2026-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc ">0c5de74</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslintrc/commit/b433a223f965b957ef3e3b8a21b77d6ac5b5d8d1 "><code>b433a22</code></a>
chore: release 3.3.6 🚀 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/236 ">#236</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc "><code>0c5de74</code></a>
fix: update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/94837a4ae3ceb0d592d880b38280c4059b50ef78 "><code>94837a4</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/dbae1a1449c05b38e50cf862e5851f415db42404 "><code>dbae1a1</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/19fe72a30f48d39bda5fa63f3dafc5106e4f3687 "><code>19fe72a</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/92ebd174471b294fd52b4f8c8b786c0087a017eb "><code>92ebd17</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/3ba4c8c2cbe1e85eed14679e0b6a28ae7fde98b7 "><code>3ba4c8c</code></a>
ci: add Node.js 26 to CI (<a
href="https://redirect.github.com/eslint/eslintrc/issues/231 ">#231</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/f8d268a51a004668bb72d20d1706f4d4a4928c87 "><code>f8d268a</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/6e20867b312094e53afa559dcad21ceeff6cac58 "><code>6e20867</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/6d722b64e8331bbd663eeb4ec55a9c03679904b7 "><code>6d722b6</code></a>
docs: Update README sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.65.0</h2>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid import defer
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12552 ">#12552</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.64.0</h2>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support parsing <code>import defer</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12513 ">#12513</a>)</li>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.63.0 (2026-07-06)</h2>
<h3>🚀 Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/63ba81b6acfa0d663c29aa0013d4672bf3b0426c "><code>63ba81b</code></a>
chore(release): publish 8.65.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/aa602bdf3f2dd460069da4f82d8acf41a7f938b8 "><code>aa602bd</code></a>
fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't
flag...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1e90d6733210f550697a062b1e79cb49ce2880e6 "><code>1e90d67</code></a>
feat(eslint-plugin): [no-shadow] specialized error on enum declaration
and me...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b32fb34305f685254059b8ceaf8bec15b1f1f77e "><code>b32fb34</code></a>
docs: fix broken code samples in no-extraneous-class and
prefer-function-type...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/eaf457631ac381aadfee747c2d098c8ac4df9d63 "><code>eaf4576</code></a>
feat: add warning when TS 7 is detected (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12529 ">#12529</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/18c01c7049e55aa346d84c06bd03d8e9daf48343 "><code>18c01c7</code></a>
feat(eslint-plugin): [no-restricted-imports] deprecate extension rule
(<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12527 ">#12527</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/96e8fe25587a6e83a7a1cd957132a2e02b451b4b "><code>96e8fe2</code></a>
fix(eslint-plugin): [unbound-method] report unbound methods accessed via
memb...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/0d06406f3181f063041dbd1621d71984127ddae1 "><code>0d06406</code></a>
chore: add attw validation to repo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12437 ">#12437</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9d9973bb181a413187468a95f84f86d9998b0658 "><code>9d9973b</code></a>
fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $
ending ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c2386e49ec6347aa92d53a1f32143ca45984cc13 "><code>c2386e4</code></a>
chore(deps): update dependency prettier to v3.9.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12486 ">#12486</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.62.1 to 8.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.65.0</h2>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid import defer
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12552 ">#12552</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.64.0</h2>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support parsing <code>import defer</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12513 ">#12513</a>)</li>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.64.0 (2026-07-13)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.63.0 (2026-07-06)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/63ba81b6acfa0d663c29aa0013d4672bf3b0426c "><code>63ba81b</code></a>
chore(release): publish 8.65.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/eaf457631ac381aadfee747c2d098c8ac4df9d63 "><code>eaf4576</code></a>
feat: add warning when TS 7 is detected (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12529 ">#12529</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d8f1044702e3257ee92c0af6681c1455563009db "><code>d8f1044</code></a>
feat(parser): add onUnsupportedTypeScriptVersion option to error on
unsupport...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/0d06406f3181f063041dbd1621d71984127ddae1 "><code>0d06406</code></a>
chore: add attw validation to repo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12437 ">#12437</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c2386e49ec6347aa92d53a1f32143ca45984cc13 "><code>c2386e4</code></a>
chore(deps): update dependency prettier to v3.9.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12486 ">#12486</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/414d9abbf66f77796ab12ec7e75b07722e592832 "><code>414d9ab</code></a>
chore(release): publish 8.64.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374 "><code>290cf6c</code></a>
chore(release): publish 8.63.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.6.0 to 10.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.8.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1 "><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082 ">#21082</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8 "><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129 ">#21129</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/90910715011211a20d011d807d398a7005127f35 "><code>9091071</code></a>
fix: prevent <code>no-unreachable-loop</code> crash when all loop types
are ignored (<a
href="https://redirect.github.com/eslint/eslint/issues/21116 ">#21116</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e23fafe8d4b15355adef6cdebef414c3a2019454 "><code>e23fafe</code></a>
fix: prefer-object-spread add semicolon when adding parenthesis (<a
href="https://redirect.github.com/eslint/eslint/issues/21081 ">#21081</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/20b5ad052360a443786a202e94624a3f81846511 "><code>20b5ad0</code></a>
fix: quadratic-time regex in <code>prefer-template</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21096 ">#21096</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8b6f6c0b33411f34485512456d94f221daf7321f "><code>8b6f6c0</code></a>
fix: apply ignore configs to computed methods in class-methods-use-this
(<a
href="https://redirect.github.com/eslint/eslint/issues/21094 ">#21094</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b2c608c014a396800a24a89343265d0616bee2d8 "><code>b2c608c</code></a>
fix: NewExpression with parenthesized callee in
<code>preserve-caught-error</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21083 ">#21083</a>)
(Francesco Trotta)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea "><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106 ">#21106</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0 "><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120 ">#21120</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7ec733a3ba5acb053a73ac656030a3879aa48fda "><code>7ec733a</code></a>
docs: Fix typos and grammar in glossary (<a
href="https://redirect.github.com/eslint/eslint/issues/21095 ">#21095</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/92bb13f13065db72d62454b9830d3ae52db15c76 "><code>92bb13f</code></a>
docs: replace quake link (<a
href="https://redirect.github.com/eslint/eslint/issues/21108 ">#21108</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/68eb4a57572409dbdcfeb3bc5c92ddbba46bc770 "><code>68eb4a5</code></a>
docs: fix broken Specify Globals anchor links in rule pages (<a
href="https://redirect.github.com/eslint/eslint/issues/21103 ">#21103</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d28f697e0d32d7446c825fd89c362db028450134 "><code>d28f697</code></a>
docs: replace Code Climate CLI links with Qlty CLI links (<a
href="https://redirect.github.com/eslint/eslint/issues/21099 ">#21099</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccc68d42564e46bc9020d19ec52d2988f3b7bfa "><code>eccc68d</code></a>
docs: correct --suppressions-location option description (<a
href="https://redirect.github.com/eslint/eslint/issues/21093 ">#21093</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c5963f74bfa82a5b7ccc0607dcdcc695b8c97a31 "><code>c5963f7</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490 "><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137 ">#21137</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320 "><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101 ">#21101</a>)
(Bo Hyun Kim)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74 "><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123 ">#21123</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc "><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118 ">#21118</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e9d66d0cde1a7752c29dee53ab7b62632835a87a "><code>e9d66d0</code></a>
ci: bump actions/setup-node from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21119 ">#21119</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ee225b60c26f0cc5f4d71641888a5bd2ec5626d6 "><code>ee225b6</code></a>
test: Add error location details to <code>no-eq-null</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21117 ">#21117</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/044a627fa3e28ee1410d515acc5378eb4b49f8ba "><code>044a627</code></a>
chore: update minimatch to ^10.2.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21107 ">#21107</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fb09aa8ff09730d3ccf68859e065f99666b52466 "><code>fb09aa8</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21115 ">#21115</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5abd878740fe417fd8a910cac3741f2a0317b365 "><code>5abd878</code></a>
test: add error locations to <code>no-proto</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21114 ">#21114</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9715887ec94a5ff936447d7b680d039fbe2f0541 "><code>9715887</code></a>
test: Add error location details to <code>no-div-regex</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21110 ">#21110</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a746ec6ea4a2249b1eb3f512264da5f4d5f7c886 "><code>a746ec6</code></a>
test: add error locations to <code>no-new-wrappers</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21109 ">#21109</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8dde64570e240f3ef8af873d59a752db6d8519aa "><code>8dde645</code></a>
test: add error locations to <code>no-ex-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21102 ">#21102</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/13ab0ec447650c079d8a5e5d67222f79e69c741e "><code>13ab0ec</code></a>
test: add error locations to <code>no-label-var</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21098 ">#21098</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a99906ffb8342dde03336b5c6372b5658f21d5f2 "><code>a99906f</code></a>
test: Add error location details to <code>no-delete-var</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21105 ">#21105</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c47e8dc9bbfba797430db45ae08cb6f7392cfc9d "><code>c47e8dc</code></a>
chore: add missing backticks to <code>languages/js/index.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21104 ">#21104</a>)
(beeen)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0174428dd7543d118cf67a823b98dd97032fe68c "><code>0174428</code></a>
chore: add missing backticks to <code>translate-cli-options.js</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21097 ">#21097</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d36589a4917326500f0707bb41745160f387d00 "><code>3d36589</code></a>
chore: add missing backticks to <code>serialization.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21091 ">#21091</a>)
(이규환)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dcc9312c1081931de0fe1b555fbb6aa82fe696b9 "><code>dcc9312</code></a>
test: add error locations to <code>eqeqeq</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21090 ">#21090</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2710b182472cd1a95e4aff6186cb2c4fbadb4ee0 "><code>2710b18</code></a>
ci: Add explicit permissions to rebuild-docs-sites workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/21089 ">#21089</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/5d2f8663ee60701e9036b0b0933a12efd9d93269 "><code>5d2f866</code></a>
chore: update dependency prettier to v3.9.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21086 ">#21086</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/d584e31098f262563b97dc5d5f23a63a187879a0 "><code>d584e31</code></a>
chore: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21084 ">#21084</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bf3eda049bd690f1e9a5a0c4520a6329b3e4ec85 "><code>bf3eda0</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21079 ">#21079</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.7.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/cf2a9bf2d982642f760370c15f1196f4658f4e27 "><code>cf2a9bf</code></a>
feat: add errorClassNames option to preserve-caught-error rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21032 ">#21032</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f8b873aae53610b80b5c1005606716e05ed3b91f "><code>f8b873a</code></a>
feat: max-nested-callbacks option for constructor callbacks (<a
href="https://redirect.github.com/eslint/eslint/issues/21063 ">#21063</a>)
(fnx)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/749dfed106f44d77bf3af2402ebfae20cdbf59ee "><code>749dfed</code></a>
10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4bd0d75b22ffd44809a92659f113c972c5be0770 "><code>4bd0d75</code></a>
Build: changelog update for 10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490 "><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137 ">#21137</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea "><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106 ">#21106</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0 "><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120 ">#21120</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8 "><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129 ">#21129</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320 "><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101 ">#21101</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74 "><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123 ">#21123</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1 "><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082 ">#21082</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc "><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118 ">#21118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.6.0...v10.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.4 to 3.9.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases ">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621 ">prettier/prettier#19621</a>
by <a href="https://github.com/kovsu "><code>@kovsu</code></a>)</li>
<li>Support <code>import defer</code> in <code>typescript</code> parser
(<a
href="https://redirect.github.com/prettier/prettier/pull/19624 ">prettier/prettier#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675 ">prettier/prettier#19675</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
<li>Added a new official plugin <a
href="https://github.com/prettier/prettier/tree/3.9.6/packages/plugin-yuku "><code>@prettier/plugin-yuku</code>
🚀 </a> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628 ">prettier/prettier#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629 ">prettier/prettier#19629</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.6/CHANGELOG.md#396 ">Changelog</a></p>
<h2>3.9.5</h2>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.5/CHANGELOG.md#395 ">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md ">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.6</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.5...3.9.6 ">diff</a></p>
<h4>TypeScript: Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621 ">#19621</a>
by <a href="https://github.com/kovsu "><code>@kovsu</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
interface Container {
"new"(id: string): number;
}
<p>// Prettier 3.9.5<br />
interface Container {<br />
new(id: string): number;<br />
}</p>
<p>// Prettier 3.9.6<br />
interface Container {<br />
"new"(id: string): number;<br />
}<br />
</code></pre></p>
<h4>TypeScript: Support <code>import defer</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19624 ">#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675 ">#19675</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
import defer * as foo from "foo";
<p>// Prettier 3.9.5<br />
import * as foo from "foo";</p>
<p>// Prettier 3.9.6<br />
import defer * as foo from "foo";<br />
</code></pre></p>
<h4>JavaScript: Added a new official plugin
<code>@prettier/plugin-yuku</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628 ">#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629 ">#19629</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<p><code>@prettier/plugin-yuku</code> is powered by <a
href="https://yuku.fyi/ ">Yuku</a> (A high-performance
JavaScript/TypeScript compiler toolchain written in Zig).</p>
<p>This plugin includes two new parsers: <code>yuku</code> (JavaScript
syntax) and <code>yuku-ts</code> (TypeScript syntax).</p>
<p><strong>To use this plugin:</strong></p>
<ol>
<li>
<p>Install the plugin:</p>
<pre lang="bash"><code>yarn add --dev prettier @prettier/plugin-yuku
</code></pre>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/8f0c95057cc91d5836409466cd9d9af3bb901e84 "><code>8f0c950</code></a>
Release 3.9.6</li>
<li><a
href="https://github.com/prettier/prettier/commit/e9107647d0497d8ff1cacbb0f970d4543df77c1c "><code>e910764</code></a>
Update changelog</li>
<li><a
href="https://github.com/prettier/prettier/commit/ec3f1c7bd74495992bc6954323a1a7fc8368808e "><code>ec3f1c7</code></a>
Update typescript-eslint to v8.65.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19675 ">#19675</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/73d2efc2c6cba6f579585c88ef171132d90834ec "><code>73d2efc</code></a>
Update Yuku parser to v0.7.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19664 ">#19664</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/dd5e24eabeab1f75ad573c79781e5fd408bcfad3 "><code>dd5e24e</code></a>
Preserve quotes for <code>TSMethodSignature</code> nodes named
<code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/issues/19621 ">#19621</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/c03ab4e71c23154d6b11537eee3c938f0d0f67d3 "><code>c03ab4e</code></a>
Update dependency eslint-plugin-unicorn to v72 (<a
href="https://redirect.github.com/prettier/prettier/issues/19633 ">#19633</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/b74dd53076c7208291a6b2e585c310844b41d35f "><code>b74dd53</code></a>
Update Yuku parser to v0.6.5 (<a
href="https://redirect.github.com/prettier/prettier/issues/19654 ">#19654</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/f1b594ea1db1520c383d0e281d623551f671f824 "><code>f1b594e</code></a>
Update dependency eslint-plugin-simple-import-sort to v14 (<a
href="https://redirect.github.com/prettier/prettier/issues/19655 ">#19655</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/0d9dfb61530986373000dd107ea58ceebb79e233 "><code>0d9dfb6</code></a>
Update Yuku parser to v0.6.4 (<a
href="https://redirect.github.com/prettier/prettier/issues/19650 ">#19650</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/3bbb8159eb55575d4042653aa99f5f92a1416c19 "><code>3bbb815</code></a>
Remove <code>typescript-only</code> directory (<a
href="https://redirect.github.com/prettier/prettier/issues/19636 ">#19636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.9.4...3.9.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ts-jest` from 29.4.11 to 29.4.12
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/releases ">ts-jest's
releases</a>.</em></p>
<blockquote>
<h2>v29.4.12</h2>
<p>Please refer to <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md ">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md ">ts-jest's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.11...v29.4.12 ">29.4.12</a>
(2026-07-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>compiler:</strong> support TypeScript 7 projects through
compatibility aliases (<a
href="https://redirect.github.com/kulshekhar/ts-jest/pull/5386 ">#5386</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/3f05625da10da954fdf0a10394385008275ddbb3 "><code>3f05625</code></a>
chore(release): 29.4.12</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/df28b27f2e60edf275866763a3cdf745360d3eae "><code>df28b27</code></a>
docs: clarify TypeScript version prerequisites</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/c8a614af419b1dcc90f3d1a7a48238ac1b637e6b "><code>c8a614a</code></a>
docs: mention TypeScript 7 setup in README</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/06c79d4cebfa785749b2f96ef2dbeffc12798c47 "><code>06c79d4</code></a>
fix: address TypeScript 7 review feedback</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/f10746008e512203ad7d8c581e2c58cc7dcd43c8 "><code>f107460</code></a>
docs: explain TypeScript 7 compatibility setup</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/33882274c1e4fc3a06cece3b21f4873182c8fee7 "><code>3388227</code></a>
test(e2e): add TypeScript compatibility matrix</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/891dc731ff9f31785ad9698e4d7cfa6078991fe6 "><code>891dc73</code></a>
fix(compiler): support TypeScript 7 compatibility aliases</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/eb135ebe819991b1e10c998915cc6db2057c4de1 "><code>eb135eb</code></a>
build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 in /examples</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/d5d80a34bc575be130db2b9f5cd0958173982cda "><code>d5d80a3</code></a>
ci: pin google osv scan action at v2.3.5</li>
<li><a
href="https://github.com/kulshekhar/ts-jest/commit/6bf293f0a4ddf468735d81fcdf04f923278e030c "><code>6bf293f</code></a>
build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /website</li>
<li>Additional commits viewable in <a
href="https://github.com/kulshekhar/ts-jest/compare/v29.4.11...v29.4.12 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 08:40:31 +00:00
dependabot[bot]
01521c1b1c
chore(deps): bump the minor-and-patch group in /libs/cli/js-monorepo-example with 8 updates ( #8489 )
...
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps the minor-and-patch group in /libs/cli/js-monorepo-example with 8
updates:
| Package | From | To |
| --- | --- | --- |
| [turbo](https://github.com/vercel/turborepo ) | `2.10.2` | `2.10.7` |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc ) | `3.3.5` |
`3.3.6` |
| [eslint](https://github.com/eslint/eslint ) | `10.6.0` | `10.8.0` |
|
[@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin )
| `8.62.1` | `8.65.0` |
|
[@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser )
| `8.62.1` | `8.65.0` |
| [prettier](https://github.com/prettier/prettier ) | `3.9.4` | `3.9.6` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs ) |
`1.2.1` | `1.2.3` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core )
| `1.4.7` | `1.4.8` |
Updates `turbo` from 2.10.2 to 2.10.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases ">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.7</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>release(turborepo): 2.10.6 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13431 ">vercel/turborepo#13431</a></li>
<li>chore: Refine bug report template help section by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13433 ">vercel/turborepo#13433</a></li>
<li>fix: Verify version after attempting codemod upgrade by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13446 ">vercel/turborepo#13446</a></li>
<li>test: Characterize JavaScript package discovery by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13440 ">vercel/turborepo#13440</a></li>
<li>refactor: Separate package graph node assembly by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13441 ">vercel/turborepo#13441</a></li>
<li>fix: Upgrade <code>@vercel/connect</code> by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13450 ">vercel/turborepo#13450</a></li>
<li>refactor: Add authoritative package knowledge by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13442 ">vercel/turborepo#13442</a></li>
<li>feat: Select runnable task entrypoints by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13452 ">vercel/turborepo#13452</a></li>
<li>refactor: Add workspace root contribution contract by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13447 ">vercel/turborepo#13447</a></li>
<li>refactor: Use package knowledge for scope selection by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13443 ">vercel/turborepo#13443</a></li>
<li>fix: Prevent mobile homepage overflow by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13453 ">vercel/turborepo#13453</a></li>
<li>docs: Document service readiness probes by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13472 ">vercel/turborepo#13472</a></li>
<li>fix: Preserve pnpm root dependencies during prune by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13476 ">vercel/turborepo#13476</a></li>
<li>fix: Preserve pnpm aliased dependencies during prune by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13477 ">vercel/turborepo#13477</a></li>
<li>release(turborepo): 2.10.7-canary.1 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13478 ">vercel/turborepo#13478</a></li>
<li>test: Add Terminal UI sanity tests by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13475 ">vercel/turborepo#13475</a></li>
<li>chore: Upgrade Next.js by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13482 ">vercel/turborepo#13482</a></li>
<li>chore: Upgrade brace-expansion by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13483 ">vercel/turborepo#13483</a></li>
<li>fix: Support multiple macOS file watch roots by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13484 ">vercel/turborepo#13484</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vercel/turborepo/compare/v2.10.6...v2.10.7 ">https://github.com/vercel/turborepo/compare/v2.10.6...v2.10.7 </a></p>
<h2>Turborepo v2.10.7-canary.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>release(turborepo): 2.10.6-canary.5 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13424 ">vercel/turborepo#13424</a></li>
<li>chore: Upgrade brace-expansion by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13429 ">vercel/turborepo#13429</a></li>
<li>chore: Update tar to 7.5.18 by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13428 ">vercel/turborepo#13428</a></li>
<li>chore: Upgrade js-yaml by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13427 ">vercel/turborepo#13427</a></li>
<li>fix: Match JIT inputs for affected tasks by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13426 ">vercel/turborepo#13426</a></li>
<li>fix: Preserve project Yarn package extensions by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13425 ">vercel/turborepo#13425</a></li>
<li>release(turborepo): 2.10.6 by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13431 ">vercel/turborepo#13431</a></li>
<li>chore: Refine bug report template help section by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13433 ">vercel/turborepo#13433</a></li>
<li>fix: Verify version after attempting codemod upgrade by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13446 ">vercel/turborepo#13446</a></li>
<li>test: Characterize JavaScript package discovery by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13440 ">vercel/turborepo#13440</a></li>
<li>refactor: Separate package graph node assembly by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13441 ">vercel/turborepo#13441</a></li>
<li>fix: Upgrade <code>@vercel/connect</code> by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13450 ">vercel/turborepo#13450</a></li>
<li>refactor: Add authoritative package knowledge by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13442 ">vercel/turborepo#13442</a></li>
<li>feat: Select runnable task entrypoints by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13452 ">vercel/turborepo#13452</a></li>
<li>refactor: Add workspace root contribution contract by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13447 ">vercel/turborepo#13447</a></li>
<li>refactor: Use package knowledge for scope selection by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13443 ">vercel/turborepo#13443</a></li>
<li>fix: Prevent mobile homepage overflow by <a
href="https://github.com/anthonyshew "><code>@anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13453 ">vercel/turborepo#13453</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/be76f17100093bd5275fad4c0e2d76ad15e88d70 "><code>be76f17</code></a>
publish 2.10.7 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/2f8a96293bdbd067fc9b1c5bc3d1b7f719f48cb9 "><code>2f8a962</code></a>
fix: Support multiple macOS file watch roots (<a
href="https://redirect.github.com/vercel/turborepo/issues/13484 ">#13484</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/549fc991af510d16ff3fc12dcf47b0725ca66ac9 "><code>549fc99</code></a>
chore: Upgrade brace-expansion (<a
href="https://redirect.github.com/vercel/turborepo/issues/13483 ">#13483</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0a329d616ec88a51ab63f975e86c35a806335b87 "><code>0a329d6</code></a>
chore: Upgrade Next.js (<a
href="https://redirect.github.com/vercel/turborepo/issues/13482 ">#13482</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/07ebd1d0426336a0fad6e3f1199eabef883a6308 "><code>07ebd1d</code></a>
test: Add Terminal UI sanity tests (<a
href="https://redirect.github.com/vercel/turborepo/issues/13475 ">#13475</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/2a02c34d10a5155febdfaafa692fac74a55f4c46 "><code>2a02c34</code></a>
release(turborepo): 2.10.7-canary.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13478 ">#13478</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/96dc00c672ff45c475504c46cbeac7502b00b02f "><code>96dc00c</code></a>
fix: Preserve pnpm aliased dependencies during prune (<a
href="https://redirect.github.com/vercel/turborepo/issues/13477 ">#13477</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0746adc7485499ce3d328087af64c22a9376db24 "><code>0746adc</code></a>
fix: Preserve pnpm root dependencies during prune (<a
href="https://redirect.github.com/vercel/turborepo/issues/13476 ">#13476</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/f925b442bd93cbe231fd4278851aefe4c68cc123 "><code>f925b44</code></a>
docs: Document service readiness probes (<a
href="https://redirect.github.com/vercel/turborepo/issues/13472 ">#13472</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/4778467eebe4801a950f6548d46320f4e7a41dab "><code>4778467</code></a>
fix: Prevent mobile homepage overflow (<a
href="https://redirect.github.com/vercel/turborepo/issues/13453 ">#13453</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.7 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@eslint/eslintrc` from 3.3.5 to 3.3.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/releases ">@eslint/eslintrc's
releases</a>.</em></p>
<blockquote>
<h2>eslintrc: v3.3.6</h2>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">3.3.6</a>
(2026-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc ">0c5de74</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md ">@eslint/eslintrc's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">3.3.6</a>
(2026-07-10)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)
(<a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc ">0c5de74</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslintrc/commit/b433a223f965b957ef3e3b8a21b77d6ac5b5d8d1 "><code>b433a22</code></a>
chore: release 3.3.6 🚀 (<a
href="https://redirect.github.com/eslint/eslintrc/issues/236 ">#236</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/0c5de746dd98ac6904ee05ca594c50c5695e88bc "><code>0c5de74</code></a>
fix: update <code>js-yaml</code> to 4.3.0 to address security
vulnerability (<a
href="https://redirect.github.com/eslint/eslintrc/issues/235 ">#235</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/94837a4ae3ceb0d592d880b38280c4059b50ef78 "><code>94837a4</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/dbae1a1449c05b38e50cf862e5851f415db42404 "><code>dbae1a1</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/19fe72a30f48d39bda5fa63f3dafc5106e4f3687 "><code>19fe72a</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/92ebd174471b294fd52b4f8c8b786c0087a017eb "><code>92ebd17</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/3ba4c8c2cbe1e85eed14679e0b6a28ae7fde98b7 "><code>3ba4c8c</code></a>
ci: add Node.js 26 to CI (<a
href="https://redirect.github.com/eslint/eslintrc/issues/231 ">#231</a>)</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/f8d268a51a004668bb72d20d1706f4d4a4928c87 "><code>f8d268a</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/6e20867b312094e53afa559dcad21ceeff6cac58 "><code>6e20867</code></a>
docs: Update README sponsors</li>
<li><a
href="https://github.com/eslint/eslintrc/commit/6d722b64e8331bbd663eeb4ec55a9c03679904b7 "><code>6d722b6</code></a>
docs: Update README sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslintrc/compare/eslintrc-v3.3.5...eslintrc-v3.3.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.6.0 to 10.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases ">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.8.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1 "><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082 ">#21082</a>)
(sethamus)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8 "><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129 ">#21129</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/90910715011211a20d011d807d398a7005127f35 "><code>9091071</code></a>
fix: prevent <code>no-unreachable-loop</code> crash when all loop types
are ignored (<a
href="https://redirect.github.com/eslint/eslint/issues/21116 ">#21116</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e23fafe8d4b15355adef6cdebef414c3a2019454 "><code>e23fafe</code></a>
fix: prefer-object-spread add semicolon when adding parenthesis (<a
href="https://redirect.github.com/eslint/eslint/issues/21081 ">#21081</a>)
(synthex-byte)</li>
<li><a
href="https://github.com/eslint/eslint/commit/20b5ad052360a443786a202e94624a3f81846511 "><code>20b5ad0</code></a>
fix: quadratic-time regex in <code>prefer-template</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21096 ">#21096</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8b6f6c0b33411f34485512456d94f221daf7321f "><code>8b6f6c0</code></a>
fix: apply ignore configs to computed methods in class-methods-use-this
(<a
href="https://redirect.github.com/eslint/eslint/issues/21094 ">#21094</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b2c608c014a396800a24a89343265d0616bee2d8 "><code>b2c608c</code></a>
fix: NewExpression with parenthesized callee in
<code>preserve-caught-error</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21083 ">#21083</a>)
(Francesco Trotta)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea "><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106 ">#21106</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0 "><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120 ">#21120</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7ec733a3ba5acb053a73ac656030a3879aa48fda "><code>7ec733a</code></a>
docs: Fix typos and grammar in glossary (<a
href="https://redirect.github.com/eslint/eslint/issues/21095 ">#21095</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/92bb13f13065db72d62454b9830d3ae52db15c76 "><code>92bb13f</code></a>
docs: replace quake link (<a
href="https://redirect.github.com/eslint/eslint/issues/21108 ">#21108</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/68eb4a57572409dbdcfeb3bc5c92ddbba46bc770 "><code>68eb4a5</code></a>
docs: fix broken Specify Globals anchor links in rule pages (<a
href="https://redirect.github.com/eslint/eslint/issues/21103 ">#21103</a>)
(Minsu)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d28f697e0d32d7446c825fd89c362db028450134 "><code>d28f697</code></a>
docs: replace Code Climate CLI links with Qlty CLI links (<a
href="https://redirect.github.com/eslint/eslint/issues/21099 ">#21099</a>)
(Jung Hyeon Jun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccc68d42564e46bc9020d19ec52d2988f3b7bfa "><code>eccc68d</code></a>
docs: correct --suppressions-location option description (<a
href="https://redirect.github.com/eslint/eslint/issues/21093 ">#21093</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c5963f74bfa82a5b7ccc0607dcdcc695b8c97a31 "><code>c5963f7</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490 "><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137 ">#21137</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320 "><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101 ">#21101</a>)
(Bo Hyun Kim)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74 "><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123 ">#21123</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc "><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118 ">#21118</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/e9d66d0cde1a7752c29dee53ab7b62632835a87a "><code>e9d66d0</code></a>
ci: bump actions/setup-node from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21119 ">#21119</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/ee225b60c26f0cc5f4d71641888a5bd2ec5626d6 "><code>ee225b6</code></a>
test: Add error location details to <code>no-eq-null</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21117 ">#21117</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/044a627fa3e28ee1410d515acc5378eb4b49f8ba "><code>044a627</code></a>
chore: update minimatch to ^10.2.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21107 ">#21107</a>)
(김채영)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fb09aa8ff09730d3ccf68859e065f99666b52466 "><code>fb09aa8</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21115 ">#21115</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5abd878740fe417fd8a910cac3741f2a0317b365 "><code>5abd878</code></a>
test: add error locations to <code>no-proto</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21114 ">#21114</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/9715887ec94a5ff936447d7b680d039fbe2f0541 "><code>9715887</code></a>
test: Add error location details to <code>no-div-regex</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21110 ">#21110</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a746ec6ea4a2249b1eb3f512264da5f4d5f7c886 "><code>a746ec6</code></a>
test: add error locations to <code>no-new-wrappers</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21109 ">#21109</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8dde64570e240f3ef8af873d59a752db6d8519aa "><code>8dde645</code></a>
test: add error locations to <code>no-ex-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21102 ">#21102</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/13ab0ec447650c079d8a5e5d67222f79e69c741e "><code>13ab0ec</code></a>
test: add error locations to <code>no-label-var</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21098 ">#21098</a>)
(Gihyeon Jeong / 정기현)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a99906ffb8342dde03336b5c6372b5658f21d5f2 "><code>a99906f</code></a>
test: Add error location details to <code>no-delete-var</code> rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21105 ">#21105</a>)
(Park Harin)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c47e8dc9bbfba797430db45ae08cb6f7392cfc9d "><code>c47e8dc</code></a>
chore: add missing backticks to <code>languages/js/index.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21104 ">#21104</a>)
(beeen)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0174428dd7543d118cf67a823b98dd97032fe68c "><code>0174428</code></a>
chore: add missing backticks to <code>translate-cli-options.js</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21097 ">#21097</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3d36589a4917326500f0707bb41745160f387d00 "><code>3d36589</code></a>
chore: add missing backticks to <code>serialization.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21091 ">#21091</a>)
(이규환)</li>
<li><a
href="https://github.com/eslint/eslint/commit/dcc9312c1081931de0fe1b555fbb6aa82fe696b9 "><code>dcc9312</code></a>
test: add error locations to <code>eqeqeq</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21090 ">#21090</a>)
(Ga eun Lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2710b182472cd1a95e4aff6186cb2c4fbadb4ee0 "><code>2710b18</code></a>
ci: Add explicit permissions to rebuild-docs-sites workflow (<a
href="https://redirect.github.com/eslint/eslint/issues/21089 ">#21089</a>)
(Marry (Subin Yang))</li>
<li><a
href="https://github.com/eslint/eslint/commit/5d2f8663ee60701e9036b0b0933a12efd9d93269 "><code>5d2f866</code></a>
chore: update dependency prettier to v3.9.5 (<a
href="https://redirect.github.com/eslint/eslint/issues/21086 ">#21086</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/d584e31098f262563b97dc5d5f23a63a187879a0 "><code>d584e31</code></a>
chore: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21084 ">#21084</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bf3eda049bd690f1e9a5a0c4520a6329b3e4ec85 "><code>bf3eda0</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21079 ">#21079</a>)
(ESLint Bot)</li>
</ul>
<h2>v10.7.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/cf2a9bf2d982642f760370c15f1196f4658f4e27 "><code>cf2a9bf</code></a>
feat: add errorClassNames option to preserve-caught-error rule (<a
href="https://redirect.github.com/eslint/eslint/issues/21032 ">#21032</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f8b873aae53610b80b5c1005606716e05ed3b91f "><code>f8b873a</code></a>
feat: max-nested-callbacks option for constructor callbacks (<a
href="https://redirect.github.com/eslint/eslint/issues/21063 ">#21063</a>)
(fnx)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/749dfed106f44d77bf3af2402ebfae20cdbf59ee "><code>749dfed</code></a>
10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4bd0d75b22ffd44809a92659f113c972c5be0770 "><code>4bd0d75</code></a>
Build: changelog update for 10.8.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/4fbf46d140120ae838db08cbe49544c985956490 "><code>4fbf46d</code></a>
test: pin <code>webpack</code> version to 5.108.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21137 ">#21137</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6ddf8587e5cfeeb7328332601bb76d98b8a198ea "><code>6ddf858</code></a>
docs: fix broken Specify Parser Options anchor link (<a
href="https://redirect.github.com/eslint/eslint/issues/21106 ">#21106</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/784dfbe98f0222426fd200153a5ce2e5624151f0 "><code>784dfbe</code></a>
docs: Clarify <code>no-eq-null</code> description (<a
href="https://redirect.github.com/eslint/eslint/issues/21120 ">#21120</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6b8d2f7589b8a7c8b91b8ca2a2ef6d46178760d8 "><code>6b8d2f7</code></a>
fix: escape reserved characters in rule id in <code>html</code>
formatter (<a
href="https://redirect.github.com/eslint/eslint/issues/21129 ">#21129</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2d063e224e9bb0ccb0a28c120f7e380a8d62f320 "><code>2d063e2</code></a>
chore: update HTTP URLs to HTTPS in JSDoc and comments (<a
href="https://redirect.github.com/eslint/eslint/issues/21101 ">#21101</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eccbe7bc9257a6c99880468e452c8dfafbf47f74 "><code>eccbe7b</code></a>
test: add error locations to <code>no-class-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21123 ">#21123</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2fee9bb7416116cbed4d8c8100b1ae713b6356a1 "><code>2fee9bb</code></a>
feat: export <code>ConfigObject</code> from <code>eslint/config</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21082 ">#21082</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7d1e4373bf626f8da76d62ce024c28928bc99bc "><code>e7d1e43</code></a>
ci: bump actions/setup-go from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21118 ">#21118</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.6.0...v10.8.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/eslint-plugin's
releases</a>.</em></p>
<blockquote>
<h2>v8.65.0</h2>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid import defer
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12552 ">#12552</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.64.0</h2>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support parsing <code>import defer</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12513 ">#12513</a>)</li>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md ">@typescript-eslint/eslint-plugin's
changelog</a>.</em></p>
<blockquote>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.63.0 (2026-07-06)</h2>
<h3>🚀 Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/63ba81b6acfa0d663c29aa0013d4672bf3b0426c "><code>63ba81b</code></a>
chore(release): publish 8.65.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/aa602bdf3f2dd460069da4f82d8acf41a7f938b8 "><code>aa602bd</code></a>
fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't
flag...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/1e90d6733210f550697a062b1e79cb49ce2880e6 "><code>1e90d67</code></a>
feat(eslint-plugin): [no-shadow] specialized error on enum declaration
and me...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b32fb34305f685254059b8ceaf8bec15b1f1f77e "><code>b32fb34</code></a>
docs: fix broken code samples in no-extraneous-class and
prefer-function-type...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/eaf457631ac381aadfee747c2d098c8ac4df9d63 "><code>eaf4576</code></a>
feat: add warning when TS 7 is detected (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12529 ">#12529</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/18c01c7049e55aa346d84c06bd03d8e9daf48343 "><code>18c01c7</code></a>
feat(eslint-plugin): [no-restricted-imports] deprecate extension rule
(<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12527 ">#12527</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/96e8fe25587a6e83a7a1cd957132a2e02b451b4b "><code>96e8fe2</code></a>
fix(eslint-plugin): [unbound-method] report unbound methods accessed via
memb...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/0d06406f3181f063041dbd1621d71984127ddae1 "><code>0d06406</code></a>
chore: add attw validation to repo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12437 ">#12437</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/9d9973bb181a413187468a95f84f86d9998b0658 "><code>9d9973b</code></a>
fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $
ending ...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c2386e49ec6347aa92d53a1f32143ca45984cc13 "><code>c2386e4</code></a>
chore(deps): update dependency prettier to v3.9.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12486 ">#12486</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@typescript-eslint/parser` from 8.62.1 to 8.65.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases ">@typescript-eslint/parser's
releases</a>.</em></p>
<blockquote>
<h2>v8.65.0</h2>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>eslint-plugin:</strong> [no-restricted-imports] deprecate
extension rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12527 ">#12527</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/19562 ">#19562</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/11889 ">#11889</a>)</li>
<li><strong>eslint-plugin:</strong> [no-shadow] specialized error on
enum declaration and member shadowing (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12578 ">#12578</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid import defer
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12552 ">#12552</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [prefer-string-starts-ends-with]
handle escaped $ ending regex literals (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12515 ">#12515</a>)</li>
<li><strong>eslint-plugin:</strong> [unbound-method] report unbound
methods accessed via member expression on union types (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12448 ">#12448</a>)</li>
<li><strong>eslint-plugin:</strong>
[no-unnecessary-parameter-property-assignment] don't flag computed
assignments with a variable key (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12568 ">#12568</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv "><code>@Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>v8.64.0</h2>
<h2>8.64.0 (2026-07-13)</h2>
<h3>🚀 Features</h3>
<ul>
<li>support parsing <code>import defer</code> (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12513 ">#12513</a>)</li>
<li><strong>eslint-plugin:</strong> [no-loop-func] support
<code>using</code> / <code>await using</code> declarations and deprecate
the rule (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12500 ">#12500</a>)</li>
<li><strong>typescript-estree:</strong> throw for invalid definite
assignment in class properties (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12543 ">#12543</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [require-array-sort-compare] handle
constrained arrays (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12512 ">#12512</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md ">@typescript-eslint/parser's
changelog</a>.</em></p>
<blockquote>
<h2>8.65.0 (2026-07-20)</h2>
<h3>🚀 Features</h3>
<ul>
<li>add warning when TS 7 is detected (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12529 ">#12529</a>)</li>
<li><strong>parser:</strong> add onUnsupportedTypeScriptVersion option
to error on unsupported TypeScript versions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12465 ">#12465</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit "><code>@StyleShit</code></a></li>
<li>Josh Goldberg ✨ </li>
<li>Kirk Waiblinger <a
href="https://github.com/kirkwaiblinger "><code>@kirkwaiblinger</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.65.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.64.0 (2026-07-13)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.64.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
<h2>8.63.0 (2026-07-06)</h2>
<p>This was a version bump only for parser to align it with other
projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0 ">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning ">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases ">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/63ba81b6acfa0d663c29aa0013d4672bf3b0426c "><code>63ba81b</code></a>
chore(release): publish 8.65.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/eaf457631ac381aadfee747c2d098c8ac4df9d63 "><code>eaf4576</code></a>
feat: add warning when TS 7 is detected (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12529 ">#12529</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/d8f1044702e3257ee92c0af6681c1455563009db "><code>d8f1044</code></a>
feat(parser): add onUnsupportedTypeScriptVersion option to error on
unsupport...</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/0d06406f3181f063041dbd1621d71984127ddae1 "><code>0d06406</code></a>
chore: add attw validation to repo (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12437 ">#12437</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/c2386e49ec6347aa92d53a1f32143ca45984cc13 "><code>c2386e4</code></a>
chore(deps): update dependency prettier to v3.9.5 (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser/issues/12486 ">#12486</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/414d9abbf66f77796ab12ec7e75b07722e592832 "><code>414d9ab</code></a>
chore(release): publish 8.64.0</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374 "><code>290cf6c</code></a>
chore(release): publish 8.63.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser ">compare
view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.9.4 to 3.9.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases ">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.9.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621 ">prettier/prettier#19621</a>
by <a href="https://github.com/kovsu "><code>@kovsu</code></a>)</li>
<li>Support <code>import defer</code> in <code>typescript</code> parser
(<a
href="https://redirect.github.com/prettier/prettier/pull/19624 ">prettier/prettier#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675 ">prettier/prettier#19675</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
<li>Added a new official plugin <a
href="https://github.com/prettier/prettier/tree/3.9.6/packages/plugin-yuku "><code>@prettier/plugin-yuku</code>
🚀 </a> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628 ">prettier/prettier#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629 ">prettier/prettier#19629</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.6/CHANGELOG.md#396 ">Changelog</a></p>
<h2>3.9.5</h2>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.9.5/CHANGELOG.md#395 ">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md ">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.9.6</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.9.5...3.9.6 ">diff</a></p>
<h4>TypeScript: Preserve quotes for methods named <code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19621 ">#19621</a>
by <a href="https://github.com/kovsu "><code>@kovsu</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
interface Container {
"new"(id: string): number;
}
<p>// Prettier 3.9.5<br />
interface Container {<br />
new(id: string): number;<br />
}</p>
<p>// Prettier 3.9.6<br />
interface Container {<br />
"new"(id: string): number;<br />
}<br />
</code></pre></p>
<h4>TypeScript: Support <code>import defer</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19624 ">#19624</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19675 ">#19675</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="tsx"><code>// Input
import defer * as foo from "foo";
<p>// Prettier 3.9.5<br />
import * as foo from "foo";</p>
<p>// Prettier 3.9.6<br />
import defer * as foo from "foo";<br />
</code></pre></p>
<h4>JavaScript: Added a new official plugin
<code>@prettier/plugin-yuku</code> (<a
href="https://redirect.github.com/prettier/prettier/pull/19628 ">#19628</a>,
<a
href="https://redirect.github.com/prettier/prettier/pull/19629 ">#19629</a>
by <a href="https://github.com/fisker "><code>@fisker</code></a>)</h4>
<p><code>@prettier/plugin-yuku</code> is powered by <a
href="https://yuku.fyi/ ">Yuku</a> (A high-performance
JavaScript/TypeScript compiler toolchain written in Zig).</p>
<p>This plugin includes two new parsers: <code>yuku</code> (JavaScript
syntax) and <code>yuku-ts</code> (TypeScript syntax).</p>
<p><strong>To use this plugin:</strong></p>
<ol>
<li>
<p>Install the plugin:</p>
<pre lang="bash"><code>yarn add --dev prettier @prettier/plugin-yuku
</code></pre>
</li>
</ol>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/8f0c95057cc91d5836409466cd9d9af3bb901e84 "><code>8f0c950</code></a>
Release 3.9.6</li>
<li><a
href="https://github.com/prettier/prettier/commit/e9107647d0497d8ff1cacbb0f970d4543df77c1c "><code>e910764</code></a>
Update changelog</li>
<li><a
href="https://github.com/prettier/prettier/commit/ec3f1c7bd74495992bc6954323a1a7fc8368808e "><code>ec3f1c7</code></a>
Update typescript-eslint to v8.65.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19675 ">#19675</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/73d2efc2c6cba6f579585c88ef171132d90834ec "><code>73d2efc</code></a>
Update Yuku parser to v0.7.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/19664 ">#19664</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/dd5e24eabeab1f75ad573c79781e5fd408bcfad3 "><code>dd5e24e</code></a>
Preserve quotes for <code>TSMethodSignature</code> nodes named
<code>new</code> (<a
href="https://redirect.github.com/prettier/prettier/issues/19621 ">#19621</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/c03ab4e71c23154d6b11537eee3c938f0d0f67d3 "><code>c03ab4e</code></a>
Update dependency eslint-plugin-unicorn to v72 (<a
href="https://redirect.github.com/prettier/prettier/issues/19633 ">#19633</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/b74dd53076c7208291a6b2e585c310844b41d35f "><code>b74dd53</code></a>
Update Yuku parser to v0.6.5 (<a
href="https://redirect.github.com/prettier/prettier/issues/19654 ">#19654</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/f1b594ea1db1520c383d0e281d623551f671f824 "><code>f1b594e</code></a>
Update dependency eslint-plugin-simple-import-sort to v14 (<a
href="https://redirect.github.com/prettier/prettier/issues/19655 ">#19655</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/0d9dfb61530986373000dd107ea58ceebb79e233 "><code>0d9dfb6</code></a>
Update Yuku parser to v0.6.4 (<a
href="https://redirect.github.com/prettier/prettier/issues/19650 ">#19650</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/3bbb8159eb55575d4042653aa99f5f92a1416c19 "><code>3bbb815</code></a>
Remove <code>typescript-only</code> directory (<a
href="https://redirect.github.com/prettier/prettier/issues/19636 ">#19636</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.9.4...3.9.6 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/core` from 1.2.1 to 1.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases ">@langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11200 ">#11200</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/08e588865927c3bf0eb2ec418cfb3fba527e14bb "><code>08e5888</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(aws): normalize and safely replay Bedrock reasoning blocks</p>
<p>Emit standard reasoning blocks with preserved signatures, omit
incomplete signature-only reasoning during replay, and retain
compatibility with legacy and redacted Bedrock reasoning.</p>
</li>
</ul>
<h2><code>@langchain/core</code><a
href="https://github.com/1 "><code>@1</code></a>.2.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11171 ">#11171</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/82bef01ad3dd5e0317e48da40707be6bccc52f94 "><code>82bef01</code></a>
Thanks <a
href="https://github.com/christian-bromann "><code>@christian-bromann</code></a>!
- fix(core): coerce string v1 AIMessage content to text blocks</p>
<p>Prevent <code>contentBlocks.push is not a function</code> when
constructing an
<code>AIMessage</code> with <code>response_metadata.output_version ===
"v1"</code> and string
<code>content</code> (common in serialized LangGraph stream
payloads).</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/82a6b8ebf1a876b0ac819f2ee0ae6c6582031cb5 "><code>82a6b8e</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11202 ">#11202</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/08e588865927c3bf0eb2ec418cfb3fba527e14bb "><code>08e5888</code></a>
fix(aws): normalize Bedrock reasoning blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11200 ">#11200</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/21aaeb0b2ea5f526702bf6b8f7e1f6da34a21d2e "><code>21aaeb0</code></a>
fix: patch 13 high/critical Dependabot alerts (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11199 ">#11199</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/782c7f2b2b5c67352736686c8d124e5f85e97fd0 "><code>782c7f2</code></a>
chore(dev): bump <code>@types/node</code> from 25.9.1 to 26.1.0 in the
types group across ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f51f338cf4dd3ba188b048b3bfa8134e9b9a64cf "><code>f51f338</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11176 ">#11176</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/09e7f6d3408323fee5e19fc9af277114b1e8c89d "><code>09e7f6d</code></a>
fix(openai): drop <code>tool_call</code> content blocks from chat
completions input (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11 ">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/a9f123a49c1c50fd32d54fe4cb15963d21252d5d "><code>a9f123a</code></a>
fix(openai): filter out content blocks the chat completions api rejects
as in...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/cc39f564a9df18655ee4ae92de3f32e251021db8 "><code>cc39f56</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11172 ">#11172</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/82bef01ad3dd5e0317e48da40707be6bccc52f94 "><code>82bef01</code></a>
fix(core): coerce string v1 AIMessage content to text blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11171 ">#11171</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8a7c5f83e570c615c6b34e1234f5972dc7a2169c "><code>8a7c5f8</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11170 ">#11170</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.1...@langchain/core@1.2.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `@langchain/langgraph` from 1.4.7 to 1.4.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases ">@langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@langchain/langgraph</code><a
href="https://github.com/1 "><code>@1</code></a>.4.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2604 ">#2604</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(pregel): wait for completed-superstep persistence with sync
durability</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f326b89365043bfa846e0b428564bcafafab4aaa "><code>f326b89</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/c201256b27d55c9aa333d3d15f6ec16c2fd7de9b "><code>c201256</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.26</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md ">@langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2604 ">#2604</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
Thanks <a href="https://github.com/hntrl "><code>@hntrl</code></a>! -
fix(pregel): wait for completed-superstep persistence with sync
durability</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/f326b89365043bfa846e0b428564bcafafab4aaa "><code>f326b89</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/c201256b27d55c9aa333d3d15f6ec16c2fd7de9b "><code>c201256</code></a>]:</p>
<ul>
<li><code>@langchain/langgraph-sdk</code><a
href="https://github.com/1 "><code>@1</code></a>.9.26</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/3dccad1391e173eead64f9e2d6dd977fdc345f7d "><code>3dccad1</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2603 ">#2603</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/42ec39460bfe0c3be017fb043c668c3204c8a175 "><code>42ec394</code></a>
fix(core): enforce sync durability barriers (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2604 ">#2604</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/644892c7db89d1c58e4928c156af3b662b85e443 "><code>644892c</code></a>
docs(langgraph): fix README logo paths (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2599 ">#2599</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/8fb6376a75c4e868fd688578e17780148132716b "><code>8fb6376</code></a>
chore: update Vitest to 4.1.9 (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2587 ">#2587</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/81f63653d388514ea71c3a6978718a8ae31278db "><code>81f6365</code></a>
chore(deps): bump the langchain group with 8 updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2578 ">#2578</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.8/libs/langgraph-core ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 08:40:06 +00:00
dependabot[bot]
52d9281005
chore(deps): bump the minor-and-patch group with 4 updates ( #8488 )
...
Bumps the minor-and-patch group with 4 updates:
[actions/checkout](https://github.com/actions/checkout ),
[docker/login-action](https://github.com/docker/login-action ),
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish )
and [dorny/paths-filter](https://github.com/dorny/paths-filter ).
Updates `actions/checkout` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases ">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518 ">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521 ">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530 ">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1 ">https://github.com/actions/checkout/compare/v7...v7.0.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md ">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518 ">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521 ">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530 ">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy "><code>@aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454 ">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439 ">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth "><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414 ">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356 ">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327 ">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286 ">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc "><code>@salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248 ">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301 ">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc "><code>@salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226 ">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple "><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305 ">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss "><code>@motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971 ">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail "><code>@mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977 ">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells "><code>@benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043 ">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross "><code>@joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044 ">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89 "><code>@nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194 ">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang "><code>@TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224 ">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc "><code>@salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236 ">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3 "><code>@jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941 ">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3 "><code>@jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946 ">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy "><code>@orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924 ">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1 "><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531 ">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07 "><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530 ">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1 "><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521 ">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541 "><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518 ">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f "><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499 ">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87 "><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474 ">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e "><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476 ">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92 "><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488 ">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22 "><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479 ">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2 "><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478 ">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `docker/login-action` from 4.2.0 to 4.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases ">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.0</h2>
<ul>
<li>Harden buildx scoped config path handling by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1059 ">docker/login-action#1059</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1095.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1051 ">docker/login-action#1051</a></li>
<li>Bump js-yaml from 5.2.1 to 5.2.2 in <a
href="https://redirect.github.com/docker/login-action/pull/1057 ">docker/login-action#1057</a></li>
<li>Bump postcss from 8.5.10 to 8.5.22 in <a
href="https://redirect.github.com/docker/login-action/pull/1056 ">docker/login-action#1056</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0 ">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0 </a></p>
<h2>v4.5.2</h2>
<ul>
<li>Surface Docker Hub OIDC error responses by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1058 ">docker/login-action#1058</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.1...v4.5.2 ">https://github.com/docker/login-action/compare/v4.5.1...v4.5.2 </a></p>
<h2>v4.5.1</h2>
<ul>
<li>Support <code>dhi.io</code> as Docker Hub OIDC registry by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1054 ">docker/login-action#1054</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.5.0...v4.5.1 ">https://github.com/docker/login-action/compare/v4.5.0...v4.5.1 </a></p>
<h2>v4.5.0</h2>
<ul>
<li><a href="https://github.com/docker/login-action#docker-hub ">Docker
Hub OIDC</a> login support by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1048 ">docker/login-action#1048</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1091.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1037 ">docker/login-action#1037</a></li>
<li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1044 ">docker/login-action#1044</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1050 ">docker/login-action#1050</a></li>
<li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a
href="https://redirect.github.com/docker/login-action/pull/1046 ">docker/login-action#1046</a></li>
<li>Bump js-yaml from 5.2.0 to 5.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1038 ">docker/login-action#1038</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0 ">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0 </a></p>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035 ">docker/login-action#1035</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034 ">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0 ">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0 </a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max "><code>@crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022 ">docker/login-action#1022</a></li>
<li>Bump <code>@aws-sdk/client-ecr</code> and
<code>@aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999 ">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030 ">docker/login-action#1030</a></li>
<li>Bump <code>@docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004 ">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027 ">docker/login-action#1027</a></li>
<li>Bump <code>@sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023 ">docker/login-action#1023</a></li>
<li>Bump <code>@sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029 ">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017 ">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028 ">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031 ">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002 ">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020 ">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019 ">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0 ">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f "><code>dbcb813</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1051 ">#1051</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc "><code>5bcb015</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752 "><code>b30b2f2</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108 "><code>9087f1e</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1057 ">#1057</a>
from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4 "><code>0009830</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92 "><code>2325523</code></a>
build(deps): bump js-yaml from 5.2.1 to 5.2.2</li>
<li><a
href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688 "><code>4ec1d4a</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1056 ">#1056</a>
from docker/dependabot/npm_and_yarn/postcss-8.5.22</li>
<li><a
href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3 "><code>5fc99ba</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1053 ">#1053</a>
from docker/dependabot/github_actions/aws-actions/co...</li>
<li><a
href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb "><code>e512bd5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1052 ">#1052</a>
from docker/dependabot/github_actions/codeql-actions...</li>
<li><a
href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5 "><code>a146c91</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1059 ">#1059</a>
from crazy-max/harden-buildx-scope-paths</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...dbcb813823bdd20940b903addbd779551569679f ">compare
view</a></li>
</ul>
</details>
<br />
Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/gh-action-pypi-publish/releases ">pypa/gh-action-pypi-publish's
releases</a>.</em></p>
<blockquote>
<h2>v1.14.2</h2>
<!-- raw HTML omitted -->
<h2>🛠️ Urgh… Another release!? Again? Explain yourself!</h2>
<p>Looking at the diff, you'll only witness updates across the
dependency tree. That's it! It's not a security fix or anything like
that even, no. But you'll want this update.</p>
<blockquote>
<p>[!tip]
So what <em>most</em> people will find useful is <a
href="https://github.com/takluyver "><code>@takluyver</code></a><a
href="https://github.com/sponsors/takluyver ">💰 </a>'s update of Twine to
v7 that we use internally (<a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416 ">#416</a>).
This version will let them upload their sdists and wheels containing
core packaging metadata v2.5 to (Test)PyPI.</p>
</blockquote>
<h2>🧐 Tell me why..</h2>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p>TL;DR non-pure-python projects with C-extensions tend to have dozens
(sometimes hundreds) wheels to upload to PyPI per release. They are
often quite big and take time to transfer over the network. People
started noticing problems and coming up with DIY sharding workarounds
like <a
href="https://redirect.github.com/aio-libs/aiohttp/pull/13226 ">aio-libs/aiohttp#13226</a>
around July 23.
On this date, projects with a good amount of bytes to publish would
start getting timeouts 5 minutes after the PyPI publishing job begun.
The same job that worked just fine before.</p>
<p>I had to start pinging upstream library and ecosystem people, on
GitHub and privately, to start making sense of what was happening.
Eventually, we collectively concluded that GitHub must've shortened the
lifetime of their OIDC identity — it seems to have used to be 10 minutes
long (at some point in the past) and is now 5 minutes, apparently. It's
not documented clearly, and we have not been able to get any clarity by
attempting to contact GitHub through private channels, using personal
connections.</p>
<p>Over the course of investigation, <a
href="https://github.com/facutuesca "><code>@facutuesca</code></a><a
href="https://github.com/sponsors/facutuesca ">💰 </a> found and fixed a
related underlying cache invalidation bug in <a
href="https://redirect.github.com/sigstore/sigstore-python/pull/1838 ">sigstore/sigstore-python#1838</a>,
which he then coordinated propagation through the dependency chain
updates in sigstore-python, pypi-attestations, gh-action-pypi-publish
and gh-action-sigstore-python.</p>
<p>Mike's also discovered that Sigstore's Rekor slowdown seems to have
become the main contributing cause of the last week's incident. He's
collected some data to support this claim: <a
href="https://publishing-five-minute-timeout.tiiny.site ">https://publishing-five-minute-timeout.tiiny.site </a>.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<h2>🫶 New Contributors</h2>
<ul>
<li><a
href="https://github.com/davidbrochart "><code>@davidbrochart</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415 ">#415</a></li>
<li><a href="https://github.com/takluyver "><code>@takluyver</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416 ">#416</a></li>
</ul>
<p><strong>🪞 Full Diff</strong>: <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2 ">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2 </a></p>
<p><strong>🧔♂️ Release Manager:</strong> <a
href="https://github.com/sponsors/webknjaz "><code>@webknjaz</code></a>
<a href="https://stand-with-ukraine.pp.ua ">🇺🇦 </a></p>
<p><strong>🙏 Special Thanks</strong> to <a
href="https://github.com/davidbrochart "><code>@davidbrochart</code></a><a
href="https://github.com/sponsors/davidbrochart ">💰 </a> and <a
href="https://github.com/Dreamsorcerer "><code>@Dreamsorcerer</code></a><a
href="https://github.com/sponsors/Dreamsorcerer ">💰 </a> for turning my
attention (in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415 ">#415</a>
and in private) to the newly surfaced corner case in GitHub's behavior
that only affected a narrow category of projects while many others
remained blissfully unaware. <a
href="https://github.com/bdraco "><code>@bdraco</code></a><a
href="https://github.com/sponsors/bdraco ">💰 </a> came up with a DIY
sharding workaround for aiohttp that served as a demo for other
projects. <a
href="https://github.com/miketheman "><code>@miketheman</code></a><a
href="https://github.com/sponsors/miketheman ">💰 </a> confirmed the
Warehouse-side details. Also, <a
href="https://github.com/jku "><code>@jku</code></a><a
href="https://github.com/sponsors/jku ">💰 </a> and <a
href="https://github.com/woodruffw "><code>@woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw ">💰 </a> helped work through,
review and release the Sigstore ecosystem upstream libs.</p>
<p><strong>💬 Discuss</strong> <a
href="https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j ">on
Bluesky 🦋 </a>, <a
href="https://mastodon.social/@webknjaz/117005132816750073 ">on Mastodon
🐘 </a> and [on GitHub][release discussion].</p>
<p>[![GH Sponsors badge]][GH Sponsors URL]</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/dc37677b2e1c63e2034f94d8a5b11f265b73ba33 "><code>dc37677</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/417 ">#417</a>
from trail-of-forks/ft/bump-deps</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/8b2f23418f024937cf97f77534a597947105e772 "><code>8b2f234</code></a>
Bump <code>pypi-attestations</code> and <code>sigstore</code></li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/78b72dbfed6e025eb89577c059edc936f8a2df14 "><code>78b72db</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416 ">#416</a>
from takluyver/twine-v7</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/92f4d2a159875dd135a7e56b7b3262f502b23a13 "><code>92f4d2a</code></a>
Update twine to v7</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/ba38be9e461d3875417946c167d0b5f3d385a247 "><code>ba38be9</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408 ">#408</a>
from adisivaprasad/bump-setup-python-v6</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/a6c5088d60d08ef54b70075735d25df696e5ccaa "><code>a6c5088</code></a>
Bump actions/setup-python from v5.6.0 to v6.2.0</li>
<li>See full diff in <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/cef221092ed1bacb1cc03d23a2d87d1d172e277b...dc37677b2e1c63e2034f94d8a5b11f265b73ba33 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `dorny/paths-filter` from 4.0.1 to 4.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/releases ">dorny/paths-filter's
releases</a>.</em></p>
<blockquote>
<h2>v4.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix warning message by <a
href="https://github.com/cgundy "><code>@cgundy</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/282 ">dorny/paths-filter#282</a></li>
<li>chore: fix GitHub spelling in logs by <a
href="https://github.com/squat "><code>@squat</code></a> in <a
href="https://redirect.github.com/dorny/paths-filter/pull/278 ">dorny/paths-filter#278</a></li>
<li>fix: use rev-parse instead of branch --show-current for older git
compat by <a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/303 ">dorny/paths-filter#303</a></li>
<li>fix: work around git dubious ownership errors in container jobs by
<a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/317 ">dorny/paths-filter#317</a></li>
<li>docs: update changelog for v4.0.2 by <a
href="https://github.com/saschabratton "><code>@saschabratton</code></a>
in <a
href="https://redirect.github.com/dorny/paths-filter/pull/318 ">dorny/paths-filter#318</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/cgundy "><code>@cgundy</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/282 ">dorny/paths-filter#282</a></li>
<li><a href="https://github.com/squat "><code>@squat</code></a> made
their first contribution in <a
href="https://redirect.github.com/dorny/paths-filter/pull/278 ">dorny/paths-filter#278</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2 ">https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md ">dorny/paths-filter's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v4.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/317 ">Work
around git dubious ownership errors in container jobs</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/303 ">Use
rev-parse instead of branch --show-current for older git compat</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/282 ">Fix
warning message</a></li>
</ul>
<h2>v4.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/255 ">Support
merge queue</a></li>
</ul>
<h2>v4.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/294 ">Update
action runtime to node24</a></li>
</ul>
<h2>v3.0.3</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/279 ">Add
missing predicate-quantifier</a></li>
</ul>
<h2>v3.0.2</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/224 ">Add
config parameter for predicate quantifier</a></li>
</ul>
<h2>v3.0.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/133 ">Compare
base and ref when token is empty</a></li>
</ul>
<h2>v3.0.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/210 ">Update to
Node.js 20</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/215 ">Update
all dependencies</a></li>
</ul>
<h2>v2.11.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/167 ">Update
@actions/core to v1.10.0 - Fixes warning about deprecated
set-output</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/168 ">Document
need for pull-requests: read permission</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/164 ">Updating
to actions/checkout@v3</a></li>
</ul>
<h2>v2.11.0</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/157 ">Set
list-files input parameter as not required</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/161 ">Update
Node.js</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/162 ">Fix
incorrect handling of Unicode characters in exec()</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/163 ">Use
Octokit pagination</a></li>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/160 ">Updates
real world links</a></li>
</ul>
<h2>v2.10.2</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/91 ">Fix
getLocalRef() returns wrong ref</a></li>
</ul>
<h2>v2.10.1</h2>
<ul>
<li><a
href="https://redirect.github.com/dorny/paths-filter/pull/85 ">Improve
robustness of change detection</a></li>
</ul>
<h2>v2.10.0</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/82 ">Add
ref input parameter</a></li>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/83 ">Fix
change detection in PR when pullRequest.changed_files is
incorrect</a></li>
</ul>
<h2>v2.9.3</h2>
<ul>
<li><a href="https://redirect.github.com/dorny/paths-filter/pull/78 ">Fix
change detection when base is a tag</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dorny/paths-filter/commit/7b450fff21473bca461d4b92ce414b9d0420d706 "><code>7b450ff</code></a>
docs: update changelog for v4.0.2 (<a
href="https://redirect.github.com/dorny/paths-filter/issues/318 ">#318</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/928037783a71f24983ea250c6e55290c1b2de54f "><code>9280377</code></a>
fix: work around git dubious ownership errors in container jobs (<a
href="https://redirect.github.com/dorny/paths-filter/issues/317 ">#317</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/f3ceefdc7ef57bc2d8560787d4b6c33e44044cec "><code>f3ceefd</code></a>
fix: use rev-parse instead of branch --show-current for older git compat
(<a
href="https://redirect.github.com/dorny/paths-filter/issues/303 ">#303</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/61f87a10cd2c304679af17bb73ef192addf33c1c "><code>61f87a1</code></a>
chore: fix GitHub spelling in logs (<a
href="https://redirect.github.com/dorny/paths-filter/issues/278 ">#278</a>)</li>
<li><a
href="https://github.com/dorny/paths-filter/commit/b82ff81ffbe6fb4b636bb5b47e37fd8d12b32632 "><code>b82ff81</code></a>
fix warning message (<a
href="https://redirect.github.com/dorny/paths-filter/issues/282 ">#282</a>)</li>
<li>See full diff in <a
href="https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:31:54 -07:00
dependabot[bot]
cd62febcfa
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 updates ( #8490 )
...
Bumps the minor-and-patch group in /libs/checkpoint with 4 updates:
[langchain-core](https://github.com/langchain-ai/langchain ),
[ruff](https://github.com/astral-sh/ruff ),
[codespell](https://github.com/codespell-project/codespell ) and
[ty](https://github.com/astral-sh/ty ).
Updates `langchain-core` from 1.4.8 to 1.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/55af8a4b8818d00dee0d04223ea4925ca849f958 "><code>55af8a4</code></a>
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/73160209c3e60a8311f6e3402686d8982d735f83 "><code>7316020</code></a>
fix(ci): repair model profile refresh workflow expressions (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39095 ">#39095</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a24f9ebe557465d0b33b41f18d9f72b7a422fe5e "><code>a24f9eb</code></a>
ci: add provider filter to model profile refresh workflow (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39094 ">#39094</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/40956c3882857050f32e3617a4776612acb827b6 "><code>40956c3</code></a>
release(fireworks): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39093 ">#39093</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/828335a920794994872fb2a742c99febbb1846a7 "><code>828335a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39092 ">#39092</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5066f1d1296214e89f9bd33a524f4d2e782260c "><code>c5066f1</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39084 ">#39084</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.2 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:31:33 -07:00
dependabot[bot]
26a92d670c
chore(deps): bump the minor-and-patch group in /libs/checkpoint-conformance with 3 updates ( #8491 )
...
Bumps the minor-and-patch group in /libs/checkpoint-conformance with 3
updates: [ruff](https://github.com/astral-sh/ruff ),
[ty](https://github.com/astral-sh/ty ) and
[langchain-core](https://github.com/langchain-ai/langchain ).
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain-core` from 1.4.8 to 1.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/55af8a4b8818d00dee0d04223ea4925ca849f958 "><code>55af8a4</code></a>
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/73160209c3e60a8311f6e3402686d8982d735f83 "><code>7316020</code></a>
fix(ci): repair model profile refresh workflow expressions (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39095 ">#39095</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a24f9ebe557465d0b33b41f18d9f72b7a422fe5e "><code>a24f9eb</code></a>
ci: add provider filter to model profile refresh workflow (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39094 ">#39094</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/40956c3882857050f32e3617a4776612acb827b6 "><code>40956c3</code></a>
release(fireworks): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39093 ">#39093</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/828335a920794994872fb2a742c99febbb1846a7 "><code>828335a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39092 ">#39092</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5066f1d1296214e89f9bd33a524f4d2e782260c "><code>c5066f1</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39084 ">#39084</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.2 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:31:21 -07:00
dependabot[bot]
4ea0cac0a4
chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 in the major group ( #8493 )
...
Bumps the major group with 1 update:
[actions/setup-python](https://github.com/actions/setup-python ).
Updates `actions/setup-python` from 6.3.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases ">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108 "><code>@priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330 ">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti "><code>@HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338 ">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad "><code>@gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336 ">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh "><code>@lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335 ">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108 "><code>@priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332 ">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot "><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328 ">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali "><code>@priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333 ">actions/setup-python#1333</a></li>
<li>Upgrade <code>@actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai "><code>@philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337 ">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh "><code>@lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335 ">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai "><code>@philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337 ">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0 ">https://github.com/actions/setup-python/compare/v6...v7.0.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97 "><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338 ">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e "><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337 ">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c "><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336 ">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932 "><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330 ">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5 "><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332 ">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5 "><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335 ">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a "><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333 ">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e "><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328 ">#1328</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:30:35 -07:00
dependabot[bot]
2cac3c0932
chore(deps-dev): bump the minor-and-patch group in /libs/cli with 4 updates ( #8495 )
...
Bumps the minor-and-patch group in /libs/cli with 4 updates:
[ruff](https://github.com/astral-sh/ruff ),
[codespell](https://github.com/codespell-project/codespell ),
[ty](https://github.com/astral-sh/ty ) and
[hatch](https://github.com/pypa/hatch ).
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `hatch` from 1.17.0 to 1.17.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/hatch/releases ">hatch's
releases</a>.</em></p>
<blockquote>
<h2>Hatchling v1.17.1</h2>
<p><em><strong>Fixed:</strong></em></p>
<ul>
<li>Fix dev mode when the project has symlinks and file inclusion is
defined with the <code>packages</code> or <code>only-include</code>
options</li>
<li>Change the name of generated PTH files for dev mode so they come
first lexicographically and therefore load first</li>
</ul>
<h2>Hatch v1.17.1</h2>
<p><em><strong>Fixed</strong></em></p>
<ul>
<li>Use <code>TemporaryDirectory</code> and pylock*.toml for temporary
lock files.</li>
<li>Skip injection of <code>ruff</code> extend if a key already exists
in <code>ruff.toml</code>.</li>
<li>Pass <code>--no-header</code> to <code>uv pip compile</code> in the
<code>uv</code> locker so that generated lockfiles are
deterministic.</li>
<li>Fix env-dependency extras being dropped when a metadata hook is
configured and resolve workspace-member extras from the member's own
metadata.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/hatch/commit/5dae0595d1dfbaa5268aeeee7d81fde604d097d8 "><code>5dae059</code></a>
release Hatch v1.17.1</li>
<li><a
href="https://github.com/pypa/hatch/commit/4b3fd7d6d8435312b16fe8e8a317be5244a81b23 "><code>4b3fd7d</code></a>
release Hatchling v1.31.0</li>
<li><a
href="https://github.com/pypa/hatch/commit/19ced89249f2249772eed4566bd40d72e25d77ec "><code>19ced89</code></a>
Fix env-dependency extras being dropped when a metadata hook is
configured (#...</li>
<li><a
href="https://github.com/pypa/hatch/commit/3b45c75a8872788f65430db1ebebcb7c24811794 "><code>3b45c75</code></a>
Prepare hatchling for release 1.31.0 (<a
href="https://redirect.github.com/pypa/hatch/issues/2330 ">#2330</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/e3d9b950dade81b08447d5609c404376f638b7c5 "><code>e3d9b95</code></a>
Addresses bug where blank lines are dropped when there is no shebang (<a
href="https://redirect.github.com/pypa/hatch/issues/2328 ">#2328</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/9bc573c3f896604325003573fcbef67dbadc0d4f "><code>9bc573c</code></a>
Prepare for 1.17.1 hatch release (<a
href="https://redirect.github.com/pypa/hatch/issues/2329 ">#2329</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/bbb12bbc31f15d1b3775a041c85467dc065a1542 "><code>bbb12bb</code></a>
Pass --no-header to uv pip compile for deterministic lockfiles (<a
href="https://redirect.github.com/pypa/hatch/issues/2327 ">#2327</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/8c0637362b0fb406a77ae89dfa83847d260f1f35 "><code>8c06373</code></a>
Fix uv lock check header comparison (<a
href="https://redirect.github.com/pypa/hatch/issues/2317 ">#2317</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/5cfbb540051d226900d087316fb5cb124de5b30f "><code>5cfbb54</code></a>
fix: skip extend injection if already present in ruff config (<a
href="https://redirect.github.com/pypa/hatch/issues/2305 ">#2305</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/cf859710577c6a2fb1f8e51e56ea6c3c49e7a50d "><code>cf85971</code></a>
fix: use TemporaryDirectory + pylock*.toml for temp lock files (<a
href="https://redirect.github.com/pypa/hatch/issues/2303 ">#2303</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/hatch/compare/hatch-v1.17.0...hatch-v1.17.1 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:30:20 -07:00
dependabot[bot]
b2af47da46
chore(deps): bump the minor-and-patch group in /libs/checkpoint-sqlite with 4 updates ( #8494 )
...
Bumps the minor-and-patch group in /libs/checkpoint-sqlite with 4
updates: [ruff](https://github.com/astral-sh/ruff ),
[codespell](https://github.com/codespell-project/codespell ),
[ty](https://github.com/astral-sh/ty ) and
[langchain-core](https://github.com/langchain-ai/langchain ).
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain-core` from 1.4.8 to 1.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/55af8a4b8818d00dee0d04223ea4925ca849f958 "><code>55af8a4</code></a>
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/73160209c3e60a8311f6e3402686d8982d735f83 "><code>7316020</code></a>
fix(ci): repair model profile refresh workflow expressions (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39095 ">#39095</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a24f9ebe557465d0b33b41f18d9f72b7a422fe5e "><code>a24f9eb</code></a>
ci: add provider filter to model profile refresh workflow (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39094 ">#39094</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/40956c3882857050f32e3617a4776612acb827b6 "><code>40956c3</code></a>
release(fireworks): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39093 ">#39093</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/828335a920794994872fb2a742c99febbb1846a7 "><code>828335a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39092 ">#39092</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5066f1d1296214e89f9bd33a524f4d2e782260c "><code>c5066f1</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39084 ">#39084</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.2 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:30:09 -07:00
dependabot[bot]
f223c6d6f4
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /libs/cli/js-monorepo-example in the major group ( #8496 )
...
Bumps the major group in /libs/cli/js-monorepo-example with 1 update:
[typescript](https://github.com/microsoft/TypeScript ).
Updates `typescript` from 6.0.3 to 7.0.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/microsoft/TypeScript/commits ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~microsoft1es ">microsoft1es</a>, a new
releaser for typescript since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:55 -07:00
dependabot[bot]
e7f05cb67c
chore(deps): bump the minor-and-patch group in /libs/checkpoint-postgres with 5 updates ( #8497 )
...
Bumps the minor-and-patch group in /libs/checkpoint-postgres with 5
updates:
| Package | From | To |
| --- | --- | --- |
| [anyio](https://github.com/agronholm/anyio ) | `4.14.1` | `4.14.2` |
| [ruff](https://github.com/astral-sh/ruff ) | `0.15.20` | `0.16.0` |
| [codespell](https://github.com/codespell-project/codespell ) | `2.4.2`
| `2.4.3` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.55` | `0.0.64` |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.4.8`
| `1.5.2` |
Updates `anyio` from 4.14.1 to 4.14.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.14.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `langchain-core` from 1.4.8 to 1.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/55af8a4b8818d00dee0d04223ea4925ca849f958 "><code>55af8a4</code></a>
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/73160209c3e60a8311f6e3402686d8982d735f83 "><code>7316020</code></a>
fix(ci): repair model profile refresh workflow expressions (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39095 ">#39095</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a24f9ebe557465d0b33b41f18d9f72b7a422fe5e "><code>a24f9eb</code></a>
ci: add provider filter to model profile refresh workflow (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39094 ">#39094</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/40956c3882857050f32e3617a4776612acb827b6 "><code>40956c3</code></a>
release(fireworks): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39093 ">#39093</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/828335a920794994872fb2a742c99febbb1846a7 "><code>828335a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39092 ">#39092</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5066f1d1296214e89f9bd33a524f4d2e782260c "><code>c5066f1</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39084 ">#39084</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.2 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:45 -07:00
dependabot[bot]
7efdf04209
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /libs/cli/js-examples in the major group ( #8498 )
...
Bumps the major group in /libs/cli/js-examples with 1 update:
[typescript](https://github.com/microsoft/TypeScript ).
Updates `typescript` from 6.0.3 to 7.0.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/microsoft/TypeScript/commits ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~microsoft1es ">microsoft1es</a>, a new
releaser for typescript since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:30 -07:00
dependabot[bot]
fa36da7e88
chore(deps-dev): bump types-requests from 2.33.0.20260518 to 2.33.0.20260712 in /libs/langgraph ( #8502 )
...
Bumps [types-requests](https://github.com/python/typeshed ) from
2.33.0.20260518 to 2.33.0.20260712.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits ">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:23 -07:00
dependabot[bot]
5efb3d2d87
chore(deps): bump the minor-and-patch group in /libs/prebuilt with 7 updates ( #8500 )
...
Bumps the minor-and-patch group in /libs/prebuilt with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain ) | `1.4.8`
| `1.5.2` |
| [syrupy](https://github.com/syrupy-project/syrupy ) | `5.3.4` | `5.5.3`
|
| [ruff](https://github.com/astral-sh/ruff ) | `0.15.20` | `0.16.0` |
| [codespell](https://github.com/codespell-project/codespell ) | `2.4.2`
| `2.4.3` |
| [ty](https://github.com/astral-sh/ty ) | `0.0.55` | `0.0.64` |
| [xxhash](https://github.com/ifduyue/python-xxhash ) | `3.8.0` | `3.8.1`
|
| [anyio](https://github.com/agronholm/anyio ) | `4.14.1` | `4.14.2` |
Updates `langchain-core` from 1.4.8 to 1.5.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases ">langchain-core's
releases</a>.</em></p>
<blockquote>
<h2>langchain-core==1.5.2</h2>
<p>Changes since langchain-core==1.5.1</p>
<p>release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)
chore: bump setuptools from 82.0.0 to 83.0.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39032 ">#39032</a>)
chore: bump jupyterlab from 4.5.9 to 4.5.10 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39033 ">#39033</a>)
chore: bump setuptools from 80.9.0 to 83.0.0 in /libs/text-splitters (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39029 ">#39029</a>)</p>
<h2>langchain-core==1.5.1</h2>
<p>Changes since langchain-core==1.5.0</p>
<p>release(core): 1.5.1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39042 ">#39042</a>)
feat(anthropic,fireworks,openai): support langsmith gateway through env
var (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38742 ">#38742</a>)
fix(core): use <code>tool_call_schema</code> cache for
<code>BaseTool</code> token counting in
<code>count_tokens_approximately</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39020 ">#39020</a>)</p>
<h2>langchain-core==1.5.0</h2>
<p>Changes since langchain-core==1.4.9</p>
<p>release(core): 1.5.0 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38978 ">#38978</a>)
feat(core): add <code>reasoning_effort</code> as a standard chat model
parameter (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38887 ">#38887</a>)
chore: bump soupsieve from 2.8 to 2.8.4 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38750 ">#38750</a>)
chore: bump mistune from 3.2.1 to 3.3.0 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38783 ">#38783</a>)</p>
<h2>langchain-core==1.4.9</h2>
<p>Changes since langchain-core==1.4.8</p>
<p>release(core): 1.4.9 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38728 ">#38728</a>)
fix(core): improve langsmith loader error messages (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35648 ">#35648</a>)
fix(core): output parser bugs in xml.py and pydantic.py (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35641 ">#35641</a>)
style(core): fix some ruff preview rules (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38656 ">#38656</a>)
fix(core): avoid <code>dict</code> shadowing in language models (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38480 ">#38480</a>)
fix(core): <code>_parse_google_docstring</code> mishandling continuation
lines with colons (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/35680 ">#35680</a>)
fix(core): add messages to bare <code>raise ValueError</code> calls (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38158 ">#38158</a>)
fix(core): use <code>asyncio.get_running_loop()</code> in async contexts
(<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38157 ">#38157</a>)
chore: bump langsmith from 0.8.0 to 0.8.18 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38319 ">#38319</a>)
chore: bump jupyterlab from 4.5.7 to 4.5.9 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38326 ">#38326</a>)
chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/core (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/38327 ">#38327</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c1ab807b1f62ad04274c28f2b7d8c3141d8ba1f2 "><code>c1ab807</code></a>
release(core): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39108 ">#39108</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/313223347f842274432d8a2968b4be407e2722d8 "><code>3132233</code></a>
fix(anthropic): preserve empty thinking field in signature_delta
streaming (#...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/b3a6d9a012681df8a8e33345c8255ca69ec0e437 "><code>b3a6d9a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39105 ">#39105</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/447b51abbccde236838524ee717682a0dd2a6c09 "><code>447b51a</code></a>
fix(anthropic): strip unsupported fields from system message content
blocks (...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/55af8a4b8818d00dee0d04223ea4925ca849f958 "><code>55af8a4</code></a>
fix(core): handle empty string in gateway env vars (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39107 ">#39107</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/73160209c3e60a8311f6e3402686d8982d735f83 "><code>7316020</code></a>
fix(ci): repair model profile refresh workflow expressions (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39095 ">#39095</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a24f9ebe557465d0b33b41f18d9f72b7a422fe5e "><code>a24f9eb</code></a>
ci: add provider filter to model profile refresh workflow (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39094 ">#39094</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/40956c3882857050f32e3617a4776612acb827b6 "><code>40956c3</code></a>
release(fireworks): 1.5.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39093 ">#39093</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/828335a920794994872fb2a742c99febbb1846a7 "><code>828335a</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39092 ">#39092</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c5066f1d1296214e89f9bd33a524f4d2e782260c "><code>c5066f1</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39084 ">#39084</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.5.2 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `syrupy` from 5.3.4 to 5.5.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/releases ">syrupy's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.3</h2>
<h2>What's Changed</h2>
<p>This release has no functional changes. It just fixes an issue where
the release tag pointed to the previous commit instead of the commit
with the updated pyproject.toml (see <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">syrupy-project/syrupy#1144</a>).</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 ">https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 </a></p>
<h2>v5.5.2</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> by <a
href="https://github.com/mgorny "><code>@mgorny</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mgorny "><code>@mgorny</code></a> made
their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 ">https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 </a></p>
<h2>v5.5.1</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Defer registering <code>pytest-xdist</code> hook
<code>pytest_testnodedown</code> to avoid "unknown hook" error
by <a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 ">https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 </a></p>
<h2>v5.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: detect unused snapshots under pytest-xdist by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1132 ">syrupy-project/syrupy#1132</a></li>
</ul>
<blockquote>
<p><strong>NOTE</strong>: Test suites using pytest-xdist that previously
passed due to incomplete snapshot support may now fail if unused
snapshots are detected. You can use <code>--snapshot-warn-unused</code>
to downgrade unused snapshot detection from an error to a warning though
it's not recommended.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 ">https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 </a></p>
<h2>v5.4.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: add --snapshot-no-cleanup to keep unused snapshots on update
by <a href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1126 ">syrupy-project/syrupy#1126</a></li>
<li>fix: honor boolean operators in -k snapshot selection by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1127 ">syrupy-project/syrupy#1127</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.4.0 ">https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.4.0 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md ">syrupy's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.3 ">v5.5.3</a>
(2026-07-11)</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1143 ">syrupy-project/syrupy#1143</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.1 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1145 ">syrupy-project/syrupy#1145</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1147 ">syrupy-project/syrupy#1147</a></li>
<li>chore(deps): update dependency mypy to v2.2.0 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1148 ">syrupy-project/syrupy#1148</a></li>
<li>chore(deps): update dependency hypothesis to v6.156.3 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1150 ">syrupy-project/syrupy#1150</a></li>
<li>chore: closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">#1144</a>
by <a href="https://github.com/noahnu "><code>@noahnu</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1146 ">syrupy-project/syrupy#1146</a></li>
<li>chore(deps): update astral-sh/setup-uv action to v8.3.2 by <a
href="https://github.com/renovate "><code>@renovate</code></a>[bot] in
<a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1149 ">syrupy-project/syrupy#1149</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 ">https://github.com/syrupy-project/syrupy/compare/v5.5.2...v5.5.3 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.2 ">v5.5.2</a>
(2026-07-08)</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> by <a
href="https://github.com/mgorny "><code>@mgorny</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mgorny "><code>@mgorny</code></a> made
their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1142 ">syrupy-project/syrupy#1142</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 ">https://github.com/syrupy-project/syrupy/compare/v5.5.1...v5.5.2 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.1 ">v5.5.1</a>
(2026-07-06)</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Defer registering <code>pytest-xdist</code> hook
<code>pytest_testnodedown</code> to avoid "unknown hook" error
by <a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edgarrmondragon "><code>@edgarrmondragon</code></a>
made their first contribution in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1140 ">syrupy-project/syrupy#1140</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 ">https://github.com/syrupy-project/syrupy/compare/v5.5.0...v5.5.1 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.5.0 ">v5.5.0</a>
(2026-07-06)</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: detect unused snapshots under pytest-xdist by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1132 ">syrupy-project/syrupy#1132</a></li>
</ul>
<blockquote>
<p><strong>NOTE</strong>: Test suites using pytest-xdist that previously
passed due to incomplete snapshot support may now fail if unused
snapshots are detected. You can use <code>--snapshot-warn-unused</code>
to downgrade unused snapshot detection from an error to a warning though
it's not recommended.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 ">https://github.com/syrupy-project/syrupy/compare/v5.4.0...v5.5.0 </a></p>
<h2><a
href="https://github.com/syrupy-project/syrupy/releases/tag/v5.4.0 ">v5.4.0</a>
(2026-07-01)</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: add --snapshot-no-cleanup to keep unused snapshots on update
by <a href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1126 ">syrupy-project/syrupy#1126</a></li>
<li>fix: honor boolean operators in -k snapshot selection by <a
href="https://github.com/frenck "><code>@frenck</code></a> in <a
href="https://redirect.github.com/syrupy-project/syrupy/pull/1127 ">syrupy-project/syrupy#1127</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3cd347306cf44db076d2e4f50f7dfd325d9b5a92 "><code>3cd3473</code></a>
chore(release): 5.5.3 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/fed7e9f69f4dd14b39360e626236c868147588d5 "><code>fed7e9f</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.2 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1149 ">#1149</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/443fc11bf67ce588753cd4518ef056463cfe651b "><code>443fc11</code></a>
chore: closes <a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1144 ">#1144</a>
(<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1146 ">#1146</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/56bf157ce4135bde78ecc49cfa9532ffa41659e8 "><code>56bf157</code></a>
chore(deps): update dependency hypothesis to v6.156.3 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1150 ">#1150</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/f9c725a5653677bfcafb53645c9a078f3aa79d87 "><code>f9c725a</code></a>
chore(deps): update dependency mypy to v2.2.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1148 ">#1148</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/3af2ccf2feeadb3a0d4e3f418d22ad3395725c80 "><code>3af2ccf</code></a>
chore(deps): update dependency hypothesis to v6.156.2 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1147 ">#1147</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/feaa22ca4c211dfcdd8d0d048112531fd6cb344c "><code>feaa22c</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.1 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1145 ">#1145</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/5c59701e411922a464497398f5df25d76f2f9dcd "><code>5c59701</code></a>
chore(deps): update astral-sh/setup-uv action to v8.3.0 (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1143 ">#1143</a>)</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/1cbf7167ff114e3012b1c139661777c1a0b692ee "><code>1cbf716</code></a>
chore(release): 5.5.2 [skip ci]</li>
<li><a
href="https://github.com/syrupy-project/syrupy/commit/4f83490d2ebf4ae22aeba6d9946979640151aa34 "><code>4f83490</code></a>
fix: Fix detecting <code>pytest-xdist</code> when loaded via
<code>PYTEST_PLUGINS</code> (<a
href="https://redirect.github.com/syrupy-project/syrupy/issues/1142 ">#1142</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/syrupy-project/syrupy/compare/v5.3.4...v5.5.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ruff` from 0.15.20 to 0.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases ">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more opinionated pycodestyle (<code>E</code>)
and pyflakes (<code>F</code>) rules have been removed from the default
set: <code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the <a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and <code>gitlab</code>
outputs for rendering annotations in CI:</p>
<pre lang="console"><code>❯ ruff format --check --output-format github .
::error title=ruff
(unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8:
unformatted: File would be reformatted
</code></pre>
<p>See the CLI help or <a
href="https://docs.astral.sh/ruff/settings/#output-format ">documentation</a>
for the full list of supported formats.</p>
</li>
<li>
<p>The <code>filename</code>, <code>location</code>,
<code>end_location</code>, <code>fix.edits[].location</code>, and
<code>fix.edits[].end_location</code> fields in the JSON output format
may now be <code>null</code> rather than defaulting to the empty string
and row 1, column 1, respectively.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md ">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.0</h2>
<p>Released on 2026-07-23.</p>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0 ">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p>Ruff now enables a much larger set of rules by default (413, up from
59). See the blog post for
more details and the new <a
href="https://docs.astral.sh/ruff/default-rules/ ">Default Rules</a> page
for a
full listing of the enabled rules. Note that this is primarily an
expansion, but 18 of the more
opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>)
rules have been removed from the default set:
<code>E401</code>, <code>E402</code>, <code>E701</code>,
<code>E702</code>, <code>E703</code>, <code>E711</code>,
<code>E712</code>, <code>E713</code>, <code>E714</code>,
<code>E721</code>, <code>E731</code>, <code>E741</code>,
<code>E742</code>, <code>E743</code>, <code>F403</code>,
<code>F405</code>, <code>F406</code>, and <code>F722</code>.</p>
</li>
<li>
<p>Ruff can now format Python code blocks in Markdown files and will do
this by default. See the
<a
href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting ">documentation</a>
for more details.</p>
</li>
<li>
<p>Ruff now supports <code>ruff: ignore</code> comments at the ends of
lines, like <code>noqa</code> comments, or on the line preceding a
diagnostic. For example, these both suppress an <a
href="https://docs.astral.sh/ruff/rules/unused-import/ "><code>unused-import</code></a>
(<code>F401</code>) diagnostic:</p>
<pre lang="py"><code>import math # ruff: ignore[F401]
<h1>ruff: ignore[F401]</h1>
<p>import os
</code></pre></p>
</li>
<li>
<p>Fixes are now shown in <code>check</code> and <code>format
--check</code> output:</p>
<pre lang="console"><code>❯ ruff format --check .
unformatted: File would be reformatted
--> try.md:1:1
|
1 | ```python
- import math
2 + import math
3 | ```
|
<p>1 file would be reformatted
</code></pre></p>
<p>This example also shows off the Markdown formatting.</p>
</li>
<li>
<p><code>format --check</code> now supports the same output formats as
the linter, including the <code>github</code> and
<code>gitlab</code> outputs for rendering annotations in CI:</p>
<pre lang="console"><code></code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9 "><code>a2635fd</code></a>
Bump 0.16.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27136 ">#27136</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae "><code>3433449</code></a>
[ty] Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27115 ">#27115</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78 "><code>2240070</code></a>
Reflect <code>ruff: ignore</code> and <code>--add-ignore</code>
stabilization in documentation (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27 ">#27</a>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e "><code>17ef711</code></a>
Stabilize <code>--add-ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27125 ">#27125</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3 "><code>ef912bb</code></a>
Add newly stabilized rules to defaults (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27055 ">#27055</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3 "><code>b30f040</code></a>
Stabilize new default rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27035 ">#27035</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a "><code>bcd70c5</code></a>
Exclude Markdown files from <code>format-dev</code> runs (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27052 ">#27052</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0 "><code>87e51e2</code></a>
Fix <code>format --check</code> spans for syntax errors (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27045 ">#27045</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e "><code>afe2723</code></a>
[<code>flake8-gettext</code>] Stabilize qualified-name and built-in
binding resolution (...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df "><code>a9702d8</code></a>
[<code>flake8-bandit</code>] Stabilize string literal binding resolution
(<code>S310</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/issues/26944 ">#26944</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.15.20...0.16.0 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `codespell` from 2.4.2 to 2.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/codespell-project/codespell/releases ">codespell's
releases</a>.</em></p>
<blockquote>
<h2>v2.4.3</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add 'radback' to dictionary with correction by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3883 ">codespell-project/codespell#3883</a></li>
<li>Add 'repetirion' to dictionary corrections by <a
href="https://github.com/Flo3561 "><code>@Flo3561</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3885 ">codespell-project/codespell#3885</a></li>
<li>Need to specify a version of Python version after all by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3887 ">codespell-project/codespell#3887</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3889 ">codespell-project/codespell#3889</a></li>
<li>Add cases for "modulle" -> "module" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3888 ">codespell-project/codespell#3888</a></li>
<li>Add case "auido" -> "audio" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3890 ">codespell-project/codespell#3890</a></li>
<li>Add credentilas->credentials and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3895 ">codespell-project/codespell#3895</a></li>
<li>Add the case "cubid" -> "cubic" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3891 ">codespell-project/codespell#3891</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3897 ">codespell-project/codespell#3897</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3900 ">codespell-project/codespell#3900</a></li>
<li>Bump codecov/codecov-action from 5 to 6 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3902 ">codespell-project/codespell#3902</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3904 ">codespell-project/codespell#3904</a></li>
<li>Add <code>magntiude->magnitude</code> by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3899 ">codespell-project/codespell#3899</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3909 ">codespell-project/codespell#3909</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3912 ">codespell-project/codespell#3912</a></li>
<li>Add the case "instanc" -> "instance" by <a
href="https://github.com/utzcoz "><code>@utzcoz</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3896 ">codespell-project/codespell#3896</a></li>
<li>gampad -> gamepad (and plural) by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3906 ">codespell-project/codespell#3906</a></li>
<li>Add typos of <code>monotonic</code> and <code>monotonicity</code> by
<a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3898 ">codespell-project/codespell#3898</a></li>
<li>Add spelling correction for multipile(s)/vulnerabities. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3905 ">codespell-project/codespell#3905</a></li>
<li>Add 'simpilfy -> simplify' by <a
href="https://github.com/alexreinking "><code>@alexreinking</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3913 ">codespell-project/codespell#3913</a></li>
<li>fix(packaging): prevent unwanted files and tests from being
installed by <a
href="https://github.com/mikelolasagasti "><code>@mikelolasagasti</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3911 ">codespell-project/codespell#3911</a></li>
<li>Add skarhoj->SKAARHOJ to dictionary corrections by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3908 ">codespell-project/codespell#3908</a></li>
<li>Improve the dictionary by <a
href="https://github.com/algonell "><code>@algonell</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3914 ">codespell-project/codespell#3914</a></li>
<li>Add spelling correction for accorss/accors. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3916 ">codespell-project/codespell#3916</a></li>
<li>Bump autofix-ci/action from 1.3.3 to 1.3.4 by <a
href="https://github.com/dependabot "><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3921 ">codespell-project/codespell#3921</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3923 ">codespell-project/codespell#3923</a></li>
<li>Add <code>influecer->influencer</code> and <code>influnce*</code>
typos to dictionary by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3925 ">codespell-project/codespell#3925</a></li>
<li>Add typos for <code>excavate</code> and variants by <a
href="https://github.com/nathanjmcdougall "><code>@nathanjmcdougall</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3926 ">codespell-project/codespell#3926</a></li>
<li>Dict: Add corrections for memoy by <a
href="https://github.com/mdeweerd "><code>@mdeweerd</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3924 ">codespell-project/codespell#3924</a></li>
<li><code>overheda -> overhead</code> by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3919 ">codespell-project/codespell#3919</a></li>
<li><code>inclusize->inclusive</code> and variants by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3918 ">codespell-project/codespell#3918</a></li>
<li>Add spelling corrections for authorization by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3922 ">codespell-project/codespell#3922</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3927 ">codespell-project/codespell#3927</a></li>
<li>Don't fix Voight by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3929 ">codespell-project/codespell#3929</a></li>
<li>Add spelling corrections for interstect and interstection by <a
href="https://github.com/korli "><code>@korli</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3928 ">codespell-project/codespell#3928</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3930 ">codespell-project/codespell#3930</a></li>
<li>Improve output in interactive mode by <a
href="https://github.com/darkmattercoder "><code>@darkmattercoder</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3884 ">codespell-project/codespell#3884</a></li>
<li>feat: support codespell:ignore-next-line directive by <a
href="https://github.com/SAY-5 "><code>@SAY-5</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3931 ">codespell-project/codespell#3931</a></li>
<li>Add woork->work and formace->format and friends by <a
href="https://github.com/peternewman "><code>@peternewman</code></a> in
<a
href="https://redirect.github.com/codespell-project/codespell/pull/3828 ">codespell-project/codespell#3828</a></li>
<li>shortctu -> shortcut by <a
href="https://github.com/George-Ogden "><code>@George-Ogden</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3934 ">codespell-project/codespell#3934</a></li>
<li>A couple typos by <a
href="https://github.com/DimitriPapadopoulos "><code>@DimitriPapadopoulos</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3935 ">codespell-project/codespell#3935</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3937 ">codespell-project/codespell#3937</a></li>
<li>[pre-commit.ci] pre-commit autoupdate by <a
href="https://github.com/pre-commit-ci "><code>@pre-commit-ci</code></a>[bot]
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3942 ">codespell-project/codespell#3942</a></li>
<li>reclaculate->recalculate by <a
href="https://github.com/adamgann "><code>@adamgann</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3936 ">codespell-project/codespell#3936</a></li>
<li>Add spelling correction for improprt. by <a
href="https://github.com/cfi-gb "><code>@cfi-gb</code></a> in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3939 ">codespell-project/codespell#3939</a></li>
<li>Dictionary plasic-plastic by <a
href="https://github.com/julianstirling "><code>@julianstirling</code></a>
in <a
href="https://redirect.github.com/codespell-project/codespell/pull/3938 ">codespell-project/codespell#3938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codespell-project/codespell/commit/57b21406f092110c18776e39b0bda50d37c945c8 "><code>57b2140</code></a>
Read only [tool.codespell] from TOML config (<a
href="https://redirect.github.com/codespell-project/codespell/issues/3975 ">#3975</a>)</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/23b8d940332bcff6369872b53964d4137c586728 "><code>23b8d94</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/926c4d6ff083acc62bc04c102e0a9b2091d754f1 "><code>926c4d6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/820a3011e0bfe3f90789ba41e751a26656bea7ab "><code>820a301</code></a>
Merge pull request <a
href="https://redirect.github.com/codespell-project/codespell/issues/3967 ">#3967</a>
from codespell-project/peternewman-patch-1</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/9fe42c964c90f65a9a2841847af4e093c67ec817 "><code>9fe42c9</code></a>
Add common misspellings for reseeve->reserve to dictionary</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/725173c815cee1b781b85ec51eb43dc4f51dcd0f "><code>725173c</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/86c13ee4dce0010e8d8119ded33694806e37ca8f "><code>86c13ee</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/7b9f36ce634c551107a3a4a5c25782a2245d7658 "><code>7b9f36c</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/bcc1b804a83b8a146586101431b063c07cfcc699 "><code>bcc1b80</code></a>
Add spelling corrections for simpe and variants.</li>
<li><a
href="https://github.com/codespell-project/codespell/commit/89584cc1479d0f8dbfd501925673b6be6d460fe1 "><code>89584cc</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ty` from 0.0.55 to 0.0.64
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/releases ">ty's
releases</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<h2>Release Notes</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md ">ty's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.64</h2>
<p>Released on 2026-07-27.</p>
<h3>Bug fixes</h3>
<ul>
<li>Fix identity narrowing for NewTypes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26439 ">#26439</a>)</li>
<li>Make reachability analysis idempotent (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27163 ">#27163</a>)</li>
</ul>
<h3>LSP server</h3>
<ul>
<li>Fix ParamSpec declaration hover and type navigation (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27183 ">#27183</a>)</li>
<li>Implement LSP <code>textDocument/implementation</code> request (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25410 ">#25410</a>)</li>
<li>Introduce shared primitives for parsing backticks in docstrings (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26928 ">#26928</a>)</li>
<li>Render NumPy docstrings as structured Markdown (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25925 ">#25925</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Add <code>--exclude-scripts</code> and
<code>--include-scripts</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27169 ">#27169</a>)</li>
<li>Discover uv workspace roots (<a
href="https://redirect.github.com/astral-sh/ruff/pull/25551 ">#25551</a>)</li>
</ul>
<h3>Diagnostics</h3>
<ul>
<li>Add a lint rule for combined abstract and final decorators (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26932 ">#26932</a>)</li>
<li>Change <code>--add-ignore</code> to add space after the colon for
<code>ty: ignore</code> (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27120 ">#27120</a>)</li>
<li>Fix <code>missing-override-decorator</code> suggestion before Python
3.12 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27166 ">#27166</a>)</li>
<li>Reuse full call diagnostics for implicit setter calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27115 ">#27115</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Allow unresolved unused venv home paths (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27162 ">#27162</a>)</li>
<li>Simplify script metadata query (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27121 ">#27121</a>)</li>
</ul>
<h3>Core type checking</h3>
<ul>
<li>Decorate only overload implementation signatures (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27147 ">#27147</a>)</li>
<li>Don't consider known-instance types, generic aliases or
non-singleton special-form types to be single-valued (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27137 ">#27137</a>)</li>
<li>Improve identity comparison inference for singleton types (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27126 ">#27126</a>)</li>
<li>Improve tuple membership and rich comparison inference (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27164 ">#27164</a>)</li>
<li>Model walrus bindings from comprehensions (<a
href="https://redirect.github.com/astral-sh/ruff/pull/26466 ">#26466</a>)</li>
<li>Narrow tagged unions using identity comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27130 ">#27130</a>)</li>
<li>Preserve <code>Self</code> in <code>__new__</code> calls (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27003 ">#27003</a>)</li>
<li>Preserve receiver constraints when binding overloaded methods (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27038 ">#27038</a>)</li>
<li>Support generic manual PEP 695 type aliases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27083 ">#27083</a>)</li>
<li>Treat bivariance as covariant (<a
href="https://redirect.github.com/astral-sh/ruff/pull/24319 ">#24319</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid cycles when resolving <code>ModuleType</code> globals (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27182 ">#27182</a>)</li>
<li>Avoid expanding optional enum comparisons (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27105 ">#27105</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ty/commit/5e64a131b436a4e1f40e6317c526f4fc73fab38b "><code>5e64a13</code></a>
Bump version to 0.0.64 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4097 ">#4097</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/46f4915e67aad965b1b4e7478a75378e8e52ff6d "><code>46f4915</code></a>
Bump version to 0.0.63 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4071 ">#4071</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/df75992e7fd0cc73cb0f66e864df3f6e4fc4e1a6 "><code>df75992</code></a>
Bump version to 0.0.62 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4057 ">#4057</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/48dd1fdf8a5bd504a19e06046c3be4f3fe378747 "><code>48dd1fd</code></a>
Update prek dependencies (<a
href="https://redirect.github.com/astral-sh/ty/issues/4059 ">#4059</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/f53a95ed5fbce64e01558d643ccd4f19c9c51c72 "><code>f53a95e</code></a>
Update astral-sh/setup-uv action to v9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4060 ">#4060</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/17d179163cd5fa6707a388de9840ed9c5b4f3f1e "><code>17d1791</code></a>
Update dependency prek to v0.4.9 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4058 ">#4058</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/eb7e7ba2daa892e67d1449e2489a1176e6a48711 "><code>eb7e7ba</code></a>
Update documentation on mypy/pyright <code>--strict</code> parity, and
achieving maximum...</li>
<li><a
href="https://github.com/astral-sh/ty/commit/56b2c249200a76c384f0c194328e0a50bef297ba "><code>56b2c24</code></a>
Update changelog for 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4028 ">#4028</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/4c865c8285814582898d17aebb76b32e46f06daf "><code>4c865c8</code></a>
Bump version to 0.0.61 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4027 ">#4027</a>)</li>
<li><a
href="https://github.com/astral-sh/ty/commit/ae554ec78e195a51e89ef1d01b517914e186b544 "><code>ae554ec</code></a>
Bump version to 0.0.60 (<a
href="https://redirect.github.com/astral-sh/ty/issues/4008 ">#4008</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ty/compare/0.0.55...0.0.64 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `xxhash` from 3.8.0 to 3.8.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/releases ">xxhash's
releases</a>.</em></p>
<blockquote>
<h2>v3.8.1</h2>
<ul>
<li>Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning</li>
<li>Update C extension docstrings and remove stale comments</li>
</ul>
<hr />
<p>Full list of changes: <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst ">xxhash's
changelog</a>.</em></p>
<blockquote>
<p>v3.8.1 2026-07-06</p>
<pre><code>
- Register the "benchmark" pytest mark to avoid
PytestUnknownMarkWarning
- Update C extension docstrings and remove stale comments
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/0a1adf7b6a5f26b821272985a0a987cca5446c23 "><code>0a1adf7</code></a>
Release v3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa419ca1478219b7ba2ad18a8fe05ca9d29288bc "><code>aa419ca</code></a>
Prepare 3.8.1</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/e26b770f19b5eabd1c58d098206e5c9adfcef5d1 "><code>e26b770</code></a>
docs: update C extension docstrings and remove stale comments</li>
<li><a
href="https://github.com/ifduyue/python-xxhash/commit/aa69707513c4ba8c52a4bebc23f0aada7844decc "><code>aa69707</code></a>
Register the “benchmark” pytest mark</li>
<li>See full diff in <a
href="https://github.com/ifduyue/python-xxhash/compare/v3.8.0...v3.8.1 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `anyio` from 4.14.1 to 4.14.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/agronholm/anyio/releases ">anyio's
releases</a>.</em></p>
<blockquote>
<h2>4.14.2</h2>
<ul>
<li>Changed <code>ByteReceiveStream.receive()</code> implementations to
raise a <code>ValueError</code> when <code>max_bytes</code> is not a
positive integer (<a
href="https://redirect.github.com/agronholm/anyio/pull/1191 ">#1191</a>)</li>
<li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting
<code>float("inf")</code> when the limiter was instantiated
outside of an event loop. The adapter setter checked for infinity by
identity (<code>value is math.inf</code>), so only the exact
<code>math.inf</code> singleton was accepted, while every backend setter
(using <code>math.isinf()</code>) accepts any positive infinity (<a
href="https://redirect.github.com/agronholm/anyio/pull/1189 ">#1189</a>;
PR by <a
href="https://github.com/greymoth-jp "><code>@greymoth-jp</code></a>).</li>
<li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker
function writes enough data to <code>sys.stderr</code> to fill the
(undrained) pipe buffer. The worker process now redirects
<code>sys.stderr</code> to <code>os.devnull</code> as well, matching the
documented behavior</li>
<li>Fixed <code>TLSStream.wrap()</code> matching an internationalized
(unicode) host name against the peer certificate using IDNA 2003 (via
the standard library) instead of IDNA 2008, which could cause the host
name to be matched against the wrong certificate (<a
href="https://redirect.github.com/agronholm/anyio/pull/1208 ">#1208</a>)</li>
<li>Fixed <code>anyio.open_process()</code> (and
<code>run_process()</code>) ignoring the <code>extra_groups</code>
argument, as it mistakenly passed the value of the <code>group</code>
argument instead (<a
href="https://redirect.github.com/agronholm/anyio/pull/1209 ">#1209</a>)</li>
<li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and
<code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising
<code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on
the <code>trio</code> backend when there are no tokens available (<a
href="https://redirect.github.com/agronholm/anyio/pull/1218 ">#1218</a>)</li>
<li>Fixed <code>CapacityLimiter</code> on the asyncio backend
over-granting tokens (<code>borrowed_tokens</code> exceeding
<code>total_tokens</code> and <code>available_tokens</code> going
negative) when a non-blocking acquire was made in the window between a
token being released and the notified waiter resuming. The freed token
is now reserved for the woken waiter right away, so the non-blocking
acquire correctly raises <code>WouldBlock</code> (<a
href="https://redirect.github.com/agronholm/anyio/issues/1170 ">#1170</a>;
PR by <a
href="https://github.com/gaoflow "><code>@gaoflow</code></a>)</li>
<li>Fixed unnecessary CPU spin when delivering cancellation from
<code>CancelScope</code> on asyncio under certain conditions, including
improper cancel scope nesting (<a
href="https://redirect.github.com/agronholm/anyio/issues/1111 ">#1111</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71 "><code>c384f99</code></a>
Bumped up the version</li>
<li><a
href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a "><code>dbba29d</code></a>
Fixed 100% CPU spin on cancel scope misuse (<a
href="https://redirect.github.com/agronholm/anyio/issues/1217 ">#1217</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8 "><code>6bbc6c3</code></a>
Fix CapacityLimiter over-granting tokens on asyncio (<a
href="https://redirect.github.com/agronholm/anyio/issues/1172 ">#1172</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b "><code>6f82b25</code></a>
Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less
flaky</li>
<li><a
href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e "><code>be24b04</code></a>
Relaxed timeouts to fix test flakiness</li>
<li><a
href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf "><code>8113506</code></a>
Fix test flakiness caused by slow callback duration logging</li>
<li><a
href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f "><code>1e988b6</code></a>
Fixed CapacityLimiter raising trio.WouldBlock instead of
anyio.WouldBlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1 ">#1</a>...</li>
<li><a
href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62 "><code>44713f3</code></a>
Pin setup-uv to a commit sha across downstream jobs (<a
href="https://redirect.github.com/agronholm/anyio/issues/1213 ">#1213</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040 "><code>f1b7301</code></a>
Fixed stderr writes in a worker subprocess causing a deadlock (<a
href="https://redirect.github.com/agronholm/anyio/issues/1207 ">#1207</a>)</li>
<li><a
href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90 "><code>212be93</code></a>
Fix flaky test_tcp_listener_same_port using a hardcoded port (<a
href="https://redirect.github.com/agronholm/anyio/issues/1206 ">#1206</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/agronholm/anyio/compare/4.14.1...4.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:20 -07:00
dependabot[bot]
a43147ee57
chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /libs/langgraph ( #8528 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 48.0.1
to 50.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst ">cryptography's
changelog</a>.</em></p>
<blockquote>
<p>50.0.0 - 2026-07-31</p>
<pre><code>
* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors
or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which
could
act as a Bleichenbacher oracle for callers that decrypt untrusted
messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys
or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
:class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for
constructing
algorithm instances configured for use with
:class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>`
APIs are now
considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
chunked-encryption specification
<https://c2sp.org/chunked-encryption> ;`_ for streaming
authenticated
encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of
silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field
type in
the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a
non-zero
number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
``GeneralizedTime`` that carries fractional seconds or another non-DER
form,
matching the strict encoding already required for every other X.509 time
field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
:func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a
request
or response whose ``version`` field is not ``v1``, the only version
defined
by RFC 6960, matching the version validation already performed when
loading
certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now
supported
when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported
when
building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now
supported
when building against AWS-LC.
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc "><code>dcb7050</code></a>
Prepare for 50.0.0 release (<a
href="https://redirect.github.com/pyca/cryptography/issues/15372 ">#15372</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f "><code>53fccd9</code></a>
Don't leak how PKCS#7 encryptedKey decryption failed (<a
href="https://redirect.github.com/pyca/cryptography/issues/15369 ">#15369</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8 "><code>d472f97</code></a>
Add <code>from __future__ import annotations</code> to all src/ Python
files (<a
href="https://redirect.github.com/pyca/cryptography/issues/15371 ">#15371</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a "><code>908773d</code></a>
Bump downstream dependencies in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15368 ">#15368</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812 "><code>2cc07cc</code></a>
Bump BoringSSL, OpenSSL, AWS-LC in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15367 ">#15367</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66 "><code>c94ede9</code></a>
chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15366 ">#15366</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35 "><code>67a8308</code></a>
chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15365 ">#15365</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596 "><code>95018ff</code></a>
Release the GIL in one-shot AEAD encrypt/decrypt (<a
href="https://redirect.github.com/pyca/cryptography/issues/15361 ">#15361</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02 "><code>6954733</code></a>
Release the GIL during DH and DSA parameter generation (<a
href="https://redirect.github.com/pyca/cryptography/issues/15364 ">#15364</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6 "><code>6893b94</code></a>
Import _serialization instead of serialization in x509/extensions (<a
href="https://redirect.github.com/pyca/cryptography/issues/15363 ">#15363</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pyca/cryptography/compare/48.0.1...50.0.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:29:06 -07:00
dependabot[bot]
b84734d62f
chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /libs/cli ( #8529 )
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 48.0.1
to 50.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst ">cryptography's
changelog</a>.</em></p>
<blockquote>
<p>50.0.0 - 2026-07-31</p>
<pre><code>
* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors
or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which
could
act as a Bleichenbacher oracle for callers that decrypt untrusted
messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys
or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
:class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for
constructing
algorithm instances configured for use with
:class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>`
APIs are now
considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
chunked-encryption specification
<https://c2sp.org/chunked-encryption> ;`_ for streaming
authenticated
encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of
silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field
type in
the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a
non-zero
number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
``GeneralizedTime`` that carries fractional seconds or another non-DER
form,
matching the strict encoding already required for every other X.509 time
field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
:func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a
request
or response whose ``version`` field is not ``v1``, the only version
defined
by RFC 6960, matching the version validation already performed when
loading
certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now
supported
when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported
when
building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now
supported
when building against AWS-LC.
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc "><code>dcb7050</code></a>
Prepare for 50.0.0 release (<a
href="https://redirect.github.com/pyca/cryptography/issues/15372 ">#15372</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f "><code>53fccd9</code></a>
Don't leak how PKCS#7 encryptedKey decryption failed (<a
href="https://redirect.github.com/pyca/cryptography/issues/15369 ">#15369</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8 "><code>d472f97</code></a>
Add <code>from __future__ import annotations</code> to all src/ Python
files (<a
href="https://redirect.github.com/pyca/cryptography/issues/15371 ">#15371</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a "><code>908773d</code></a>
Bump downstream dependencies in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15368 ">#15368</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812 "><code>2cc07cc</code></a>
Bump BoringSSL, OpenSSL, AWS-LC in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15367 ">#15367</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66 "><code>c94ede9</code></a>
chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15366 ">#15366</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35 "><code>67a8308</code></a>
chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15365 ">#15365</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596 "><code>95018ff</code></a>
Release the GIL in one-shot AEAD encrypt/decrypt (<a
href="https://redirect.github.com/pyca/cryptography/issues/15361 ">#15361</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02 "><code>6954733</code></a>
Release the GIL during DH and DSA parameter generation (<a
href="https://redirect.github.com/pyca/cryptography/issues/15364 ">#15364</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6 "><code>6893b94</code></a>
Import _serialization instead of serialization in x509/extensions (<a
href="https://redirect.github.com/pyca/cryptography/issues/15363 ">#15363</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pyca/cryptography/compare/48.0.1...50.0.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/langgraph/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-05 01:28:46 -07:00
Elior Nataf Lackritz
b2926a0ff9
release(checkpoint-sqlite): 3.1.1 ( #8481 )
2026-07-30 14:57:02 -04:00
Elior Nataf Lackritz
fcdf520938
release(checkpoint-postgres): 3.1.1 ( #8480 )
2026-07-30 14:20:01 -04:00
Elior Nataf Lackritz
66ebe1a0da
fix(checkpoint-postgres,checkpoint-sqlite): scope namespace matching to segment boundaries ( #8478 )
...
## Summary
Namespace scoping in the Postgres and SQLite stores matched the
dot-joined prefix with `LIKE '<path>%'`, which does not respect the `.`
separator — a search scoped to `("foo",)` also returned rows under
`("foobar",)`. Scoping now matches the namespace exactly or requires the
separator before any remainder, and pattern metacharacters in labels are
escaped.
`list_namespaces` moves to segment-aware matching for prefix and suffix
conditions, since neither `LIKE` nor `GLOB` can express "any character
except the separator".
Per-package reasoning is in the commit message.
## Compatibility
`*` in a `list_namespaces` match path now spans exactly one segment,
restoring the documented behavior (`NamespacePath` documents `("cache",
"*", "v1")` as "any cache category with v1 version") and matching
`InMemoryStore`. To match at any depth, combine both conditions, which
are ANDed: `list_namespaces(prefix=["uid"], suffix=["alice"])`.
## Test plan
- [x] `make format` / `make lint` / `make test` from
`libs/checkpoint-postgres` (224 passed) and `libs/checkpoint-sqlite`
(112 passed, 3 skipped)
2026-07-30 13:52:16 -04:00
Saad Farooq
4134145734
release(langgraph): 1.2.10 ( #8462 )
...
## Summary
Releases `langgraph` 1.2.10.
Bumps the package version `1.2.9` -> `1.2.10` and propagates it into the
`langgraph`, `prebuilt`, and `sdk-py` lockfiles. No dependency floor or
source changes.
Picks up the changes landed since 1.2.9: #8389 (typed v3 `stream_events`
return and native projections), #8362 (`trace_policy` on `add_node`),
#8402 and #8403 (`TracePolicy` tag drop, then revert).
## Changes
- Update `libs/langgraph/pyproject.toml` to version `1.2.10`.
- Update the editable `langgraph` package entries in
`libs/langgraph/uv.lock`, `libs/prebuilt/uv.lock`, and
`libs/sdk-py/uv.lock`.
2026-07-28 10:49:37 -04:00
Saad Farooq