fix(deps): update non-major python dependencies#108
Open
nbl-renovate[bot] wants to merge 1 commit intomainfrom
Open
fix(deps): update non-major python dependencies#108nbl-renovate[bot] wants to merge 1 commit intomainfrom
nbl-renovate[bot] wants to merge 1 commit intomainfrom
Conversation
nbl-renovate
Bot
requested review from
abubnalitic-nbl and
ltucker
as code owners
Contributor
Vulnerability Scan: PassedImage:
Commit: c4e05cf |
nbl-renovate
Bot
force-pushed
the
renovate/non-major-python-dependencies
branch
from
1f51502 to
0e14944
Compare
nbl-renovate
Bot
changed the title
nbl-renovate
Bot
force-pushed
the
renovate/non-major-python-dependencies
branch
from
0e14944 to
69c4ccf
Compare
nbl-renovate
Bot
changed the title
nbl-renovate
Bot
force-pushed
the
renovate/non-major-python-dependencies
branch
7 times, most recently
from
f394df2 to
eb4b1ce
Compare
nbl-renovate
Bot
force-pushed
the
renovate/non-major-python-dependencies
branch
4 times, most recently
from
e344411 to
6a22a69
Compare
nbl-renovate
Bot
force-pushed
the
renovate/non-major-python-dependencies
branch
from
6a22a69 to
2bd86b2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
>=3.2.0,<4→>=3.2.4,<4>=4.5.1→>=4.6.0>=2.12.5→>=2.13.3>=2.13.1→>=2.14.0>=0.15.8→>=0.15.12Release Notes
PrefectHQ/fastmcp (fastmcp)
v3.2.4: : Patch Me If You CanCompare Source
A grab bag of fixes, hardening, and polish.
The headline behavior change: background tasks are now scoped to the authorization context rather than the MCP session, so a task kicked off by an authenticated user survives session churn and stays tied to who started it. This is a breaking change for anyone relying on the old session-scoped semantics.
Security got three meaningful upgrades.
FileUploadnow validates actual decoded base64 size instead of trusting the client-reported number, so an attacker can't claim "10 bytes" and deliver 10MB. The proxy client stops forwarding inbound HTTP headers to unrelated remote servers — previously a header meant for server A could leak to server B. And AuthKit now auto-binds token audience to the resource URL per RFC 8707, closing a token-reuse gap across MCP resources.Schema handling had a rough-edges pass.
json_schema_to_typeno longer crashes on Python keywords, boolean schemas, empty enums, or name collisions, and we added a 232K-schema crash test from APIs.guru to keep it honest. Gemini 2.5 Flash compatibility is fixed by strippingtitlefields the model rejects. Parameter descriptions are now extracted from docstrings automatically, so your tool signatures document themselves.Plus a Keycloak OAuth provider for enterprise auth, improvements to
ctx.elicit()(newresponse_title/response_description, deprecation warning when called withoutresponse_type), and dozens of smaller fixes across transforms, retry middleware, resource templates, and client disconnect handling.What's Changed
Breaking Changes⚠️
Enhancements ✨
Security 🔒
Fixes 🐞
orwithis not Nonechecks for config/override merging by @strawgate in #3833Docs 📚
Dependencies 📦
New Contributors
Full Changelog: PrefectHQ/fastmcp@v3.2.3...v3.2.4
v3.2.3: : Redis or NotCompare Source
fakeredis 2.35.0 shipped an undocumented rename (
FakeConnection→FakeAsyncRedisConnection) that broke pydocket'smemory://backend, causingfastmcp[tasks]installs to fail at startup with anImportError. This pinsfakeredis<2.35.0in thetasksextra as a stopgap until a fixed pydocket ships.What's Changed
Fixes 🐞
Docs 📚
Full Changelog: PrefectHQ/fastmcp@v3.2.2...v3.2.3
v3.2.2: : Audience AppreciationCompare Source
The Azure audience fix in 3.2.1 overcorrected: it switched token validation from
client_idtoidentifier_uri, which fixed custom Application ID URIs but broke the default case where Azure AD v2 tokens setaudto the bare client ID GUID. Both formats are now accepted.What's Changed
Fixes 🐞
Dependencies 📦
Full Changelog: PrefectHQ/fastmcp@v3.2.1...v3.2.2
v3.2.1: : Audience ParticipationCompare Source
Most of the fixes in this patch are about auth providers getting audience validation wrong. Cognito token verification was checking the
audJWT claim, but Cognito access tokens don't include one; they useclient_idinstead. Azure was hardcoding the raw client ID as the expected audience, ignoring theidentifier_uriparameter even though Entra v2.0 tokens use the Application ID URI asaud. Both now validate correctly without changing the provider API. Consent cookies also had an unbounded growth problem in high-DCR-client environments, eventually blowing past reverse proxy header limits; they're now capped as an LRU.On the OpenAPI side,
nullable: truefields from 3.0 specs were leaking into tool input schemas as-is instead of being converted to JSON Schema'stype: ["string", "null"]. Server variable templates in base URLs (likehttps://{region}.api.example.com) were also being passed through raw instead of substituted with their defaults.Smaller fixes: form submissions from Prefab UI now correctly handle unchecked boolean checkboxes, the client no longer crashes on error responses with empty or non-text content from third-party servers, and
asyncio.iscoroutinefunctionno longer emits deprecation warnings on Python 3.14.What's Changed
Breaking Changes⚠️
Enhancements ✨
Fixes 🐞
Docs 📚
Examples & Contrib 💡
Dependencies 📦
New Contributors
Full Changelog: PrefectHQ/fastmcp@v3.2.0...v3.2.1
pre-commit/pre-commit (pre-commit)
v4.6.0Compare Source
==================
Features
pre-commit hook-impl: allow--hook-dirto be missing to enable easierusage with
git2.54+ git hooks.Fixes
pre-commit hook-impl:--hook-typeis required.pydantic/pydantic (pydantic)
v2.13.3Compare Source
GitHub release
What's Changed
Fixes
AttributeErrorsubclasses withfrom_attributesby @Viicos in #13096v2.13.2Compare Source
GitHub release
What's Changed
Fixes
ValidationInfo.field_namemissing withmodel_validate_json()by @Viicos in #13084v2.13.1Compare Source
GitHub release
What's Changed
Fixes
ValidationInfo.datamissing withmodel_validate_json()by @davidhewitt in #13079v2.13.0Compare Source
GitHub release
The highlights of the v2.13 release are available in the blog post.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.
This release contains the updated
pydantic.v1namespace, matching version 1.10.26 which includes support for Python 3.14.What's Changed
See the beta releases for all changes sinces 2.12.
New Features
Changes
Fixes
Anywhen synthesizing_build_sourcesforBaseSettings.__init__()signature in the mypy plugin by @Viicos in #13049extraconfiguration by @Viicos in #13062Packaging
New Contributors
pydantic/pydantic-settings (pydantic-settings)
v2.14.0Compare Source
What's Changed
Literal[numeric Enum]coercion for CLI and env vars by @m9810223 in #811boto3-stubstotypes-boto3by @hramezani in #831BaseSettings.__init__()by @Viicos in #842cli_ignore_unknown_args=Truenot working on subcommands by @hramezani in #844python -OOby falling back tojson_schema_extraby @hramezani in #843New Contributors
Full Changelog: pydantic/pydantic-settings@v2.13.1...v2.14.0
astral-sh/ruff (ruff)
v0.15.12Compare Source
Released on 2026-04-24.
Preview features
#ruff:file-ignorefile-level suppressions (#23599)#ruff:ignorelogical-line suppressions (#23404)airflow] Implementtask-branch-as-short-circuit(AIR004) (#23579)flake8-bugbear] Fixbreak/continuehandling inloop-iterator-mutation(B909) (#24440)pylint] FixPLC2701for type parameter scopes (#24576)Rule changes
pandas-vet] Suggest.arrayas well inPD011(#24805)CLI
Documentation
pylint] FixPLR0124description not to claim self-comparison always returns the same value (#24749)pyupgrade] Expand docs on reusableTypeVars and scoping (UP046) (#24153)Contributors
v0.15.11Compare Source
Released on 2026-04-16.
Preview features
ruff] IgnoreRUF029when function is decorated withasynccontextmanager(#24642)airflow] Implementairflow-xcom-pull-in-template-string(AIR201) (#23583)flake8-bandit] FixS103false positives and negatives in mask analysis (#24424)Bug fixes
flake8-async] Omit overridden methods forASYNC109(#24648)Documentation
flake8-async] Add override mention toASYNC109docs (#24666)vim.lsp.config(#24577)Contributors
v0.15.10Compare Source
Released on 2026-04-09.
Preview features
flake8-logging] Allow closures in except handlers (LOG004) (#24464)flake8-self] MakeSLFdiagnostics robust to non-self-named variables (#24281)flake8-simplify] Make the fix forcollapsible-ifsafe inpreview(SIM102) (#24371)Bug fixes
E502fixes in f-strings and t-strings (#24410)dedent_to(#24381)pyupgrade] Fix panic caused by handling of octals (UP012) (#24390)Rule changes
ruff] Treat f-string interpolation as potential side effect (RUF019) (#24426)Server
Documentation
Contributors
v0.15.9Compare Source
Released on 2026-04-02.
Preview features
pyflakes] Flag annotated variable redeclarations asF811in preview mode (#24244)ruff] Allow dunder-named assignments in non-strict mode forRUF067(#24089)Bug fixes
flake8-errmsg] Avoid shadowing existingmsgin fix forEM101(#24363)flake8-simplify] Ignore pre-initialization references inSIM113(#24235)pycodestyle] FixW391fixes for consecutive empty notebook cells (#24236)pyupgrade] FixUP008nested class matching (#24273)pyupgrade] Ignore strings with string-only escapes (UP012) (#16058)ruff]RUF072: skip formfeeds on dedent (#24308)ruff] Avoid re-using symbol inRUF024fix (#24316)ruff] Parenthesize expression inRUF050fix (#24234)Rule changes
flake8-simplify] SuppressSIM105forexcept*before Python 3.12 (#23869)pyflakes] ExtendF507to flag%-format strings with zero placeholders (#24215)pyupgrade]UP018should detect more unnecessarily wrapped literals (UP018) (#24093)pyupgrade] FixUP008callable scope handling to support lambdas (#24274)ruff]RUF010: Mark fix as unsafe when it deletes a comment (#24270)Formatter
nested-string-quote-styleformatting option (#24312)Documentation
flake8-bugbear] Clarify RUF071 fix safety for non-path string comparisons (#24149)flake8-type-checking] Clarify import cycle wording forTC001/TC002/TC003(#24322)Other changes
|(#24343)Contributors
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.