deps(python): bump the python-minor-and-patch group with 3 updates

[dependabot]

Bumps the python-minor-and-patch group with 3 updates: cryptography, gunicorn and graphifyy.

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates gunicorn from 26.1.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates graphifyy from 0.9.48 to 0.9.51

Release notes

Sourced from graphifyy's releases.

v0.9.51

• Fix: the incomplete-build shrink guard now stays armed when a chunk came back hollow, unparseable, or omitting files, so a run that silently lost content can no longer overwrite the existing graph with a smaller one; a complete run and a retry-recovered chunk are unaffected, and --allow-partial still overrides (#3105, thanks @​abhay-codes07).
• Fix: graphify extract --force --code-only now fully rescans code (instead of skipping unchanged files and keeping stale import/alias resolution) while still carrying the existing document/semantic tier forward (#3125, thanks @​hopstreax).
• Fix: a hyperedge carried from a prior graph.json now has its members routed through the dedup survivor remap, so it no longer dangles when one of its members is merged away; an unresolvable member is dropped gracefully (#3102, thanks @​abhay-codes07).
• Fix: the cache's atexit stat-index flush no longer recreates a graphify-out/ tree that was deleted during the run, so a removed corpus stays removed (#2974, thanks @​abhay-codes07).
• Fix: Leiden clustering canonicalizes undirected edge endpoints before sorting, so community assignments no longer drift across builds or machines from networkx yielding an edge's endpoints in a different order (thanks @​ErichKinuya).
• Fix: a TypeScript/JavaScript new Foo() now emits a calls edge to the constructed class (member, chained, and generic forms), so constructor usage is visible; built-in globals like new Map() / new Promise() are not fabricated (#3116, thanks @​hopstreax).
• Fix: an Elixir function whose only clause carries a when guard (def foo(x) when is_integer(x), do: ...) is now extracted, not dropped; multi-clause, multi-condition guards, and defp are handled (#3111, thanks @​santhiprakash).
• Fix: Common Lisp node ids are now derived from the full path stem like every other extractor, so two same-basename .lisp files in different directories no longer collide on merge (thanks @​guitelesc).
• Perf: Leiden clustering now calls the graspologic_native binding directly instead of importing the full graspologic package, avoiding its heavy import chain (umap / pynndescent / numba JIT); clustering output is unchanged, and it falls back to the graspologic wrapper and then NetworkX Louvain when the native binding is absent (#3104, thanks @​Mohammad-Palla).
• Docs: the README now documents the git workflow for keeping the graph in sync — commits and branch switches rebuild automatically via the installed hooks, while git pull / git merge need a manual graphify update . (thanks @​Mohammad-Palla).

v0.9.50

• Fix: Ruby methods whose names end in !, ?, or = now keep distinct node ids, so save and save! (or foo and foo=) no longer collide into one node; the label keeps the raw spelling and member-call resolution still matches (#3077, thanks @​hopstreax).
• Fix: a Ruby call on a qualified constant receiver (ActiveRecord::Base.transaction) now matches the receiver's full constant path, so it no longer binds to an unrelated lone class named Base; an edge is emitted only on a single unambiguous match (#3078, thanks @​rohit-jsfreaky).
• Fix: a CommonJS member export wrapped in a higher-order function (exports.x = wrap(fn), module.exports.y = onCall({...}, handler)) is now captured, reaching through the wrapper to the function it wraps without fabricating the wrapper as the export's identity (#3035, thanks @​hopstreax).
• Fix: graphify merge-graphs now offsets each input's community ids so community 0 of one repo no longer fuses with community 0 of another; within-input structure is preserved and the original id is kept in local_community (#3014, thanks @​santhiprakash).
• Fix: a .graphify_root marker written by Windows PowerShell (which prepends a UTF-8 BOM) no longer breaks hook rebuilds or silently mis-roots a scan; PowerShell now writes the marker BOM-less and every reader decodes BOM-tolerantly (#3028, thanks @​rohit-jsfreaky).
• Perf: ignore-pattern evaluation no longer builds a Path and calls relative_to per pattern per file — it computes the relative path lexically in string space, parses each pattern once into a bounded process cache, and memoizes per-entry work; ignore decisions are unchanged (differential-fuzz verified) and a pattern-heavy monorepo scans dramatically faster (#2226, thanks @​Azeem1985). The **-aware matcher was also lifted out of a per-call cache closure that leaked a reference cycle each call.
• Feature: C# and TypeScript enum members now each emit a graph node with a case_of edge to their enum (matching the existing Java/Kotlin/Swift enum handling), so an enum case is visible as a member; explicit and implicit values, const enum, and quoted TypeScript member names are all handled and no built-in types are fabricated (#3063, #3064, thanks @​durmazoguzhan).
• Fix: graphify watch no longer re-triggers on its own reads — read-only inotify events (opened, closed_no_write, emitted by the watcher's own AST rebuild) are dropped, while close-after-write and create/modify/move/delete still trigger; a no-op on the macOS/Windows backends that never emit them (thanks @​Azeem1985).
• Fix: pip install graphifyy[postgres] now carries the tree-sitter-sql grammar the introspection path needs, and a missing or ABI-incompatible grammar raises an actionable error instead of silently returning zero nodes (thanks @​Azeem1985).

v0.9.49

• Feature: graphify merge-graphs now links a type declaration that two repos share — same fully-qualified namespace and name, from different repos — with a same_type_as edge, so a shared contract type is navigable across the repo boundary; two unrelated types that merely share a short name are not linked (#3007, thanks @​durmazoguzhan).
• Feature: C# properties now emit a member node per property, so a property is visible as a class member alongside fields and methods; the property's type still emits its references edge and no built-in types are fabricated (#3006, thanks @​durmazoguzhan).
• Fix: when a C/C++/Objective-C declaration and its definition merge into one node, the node now points at the definition site (the implementation body) instead of the header prototype; the pick is deterministic regardless of file order, and a declaration with no definition keeps its own site (#2990, thanks @​winesoft-namjin-yun).
• Fix: a bash command substitution on the right of an assignment (x=$(fn)) now emits a calls edge like a bare $(fn), while argument-position and process substitutions stay suppressed (#2978, thanks @​akshitj11).
• Fix: a SQL CREATE TABLE wrapped in a BEGIN/COMMIT transaction is now extracted, not just top-level DDL (#2953, thanks @​akshitj11).
• Feature: C# object-creation expressions (new Foo()) now emit a calls edge to the constructed type, so constructor usage is visible in the graph; built-in and out-of-corpus types are not fabricated and a qualified construction resolves against declared namespaces (#2997, thanks @​durmazoguzhan).
• Feature: when a C# interface has exactly one implementing class, its methods are now linked to that implementation with a dispatches_to edge, so a call through an injected dependency reaches the implementation; guarded against false links (single implementer, single case-sensitively same-named method, both ends C#) (#3003, thanks @​durmazoguzhan).
• Fix: Zig methods declared on enums and unions (not just structs) are now extracted, along with the calls in their bodies (#2999, thanks @​rajatnagda45).
• Fix: a Julia abstract type declared with a supertype (abstract type Dog <: Animal end) is now extracted with its inherits edge instead of being dropped (#3000, thanks @​rajatnagda45).
• Fix: a Common Lisp defclass whose superclass lives in another file now keeps its inherits edge — the cross-file base is a sourceless stub that the corpus rewire collapses onto the real definition (#3001, thanks @​rajatnagda45).
• Fix: PowerShell enum definitions and their members are now extracted as a real sourced node, so a [Color] type reference resolves to the enum instead of a phantom stub (#3002, thanks @​rajatnagda45).
• Fix: a semantic result with no nodes and no hyperedges is no longer cached and stamped into the manifest, so an empty or degenerate LLM reply for a file no longer freezes it out of future re-dispatch; an existing manifest carrying such a stamp is healed by re-queueing those files (#2927, thanks @​hopstreax).
• Fix: fresh semantic results are now scoped to the files actually dispatched before they reach the graph merge, so a stray fragment the model misattributes to a non-dispatched file can no longer replace that file's prior contribution (this also silences the "skipped out-of-scope source_file" warning) (#2926, thanks @​SinghAman21).
• Fix: graphify extract --code-only --force over an existing graph now preserves the document/paper/image semantic layer instead of dropping it; files deleted from disk are still pruned (#2923, thanks @​santhiprakash).
• Fix: a class that inherits from a built-in base (e.g. PHP extends \Exception) no longer collapses onto a same-named class in another language, so a PHP+TypeScript monorepo stops growing a phantom cross-language inheritance edge / god node; same-language inheritance and user classes named like a built-in still link (#2812, thanks @​ousamabenyounes).
• Fix: the git post-commit hook now resolves graphify when it is installed as a uv tool, by scanning the uv tool locations after the pin and launcher probes miss and verifying graphify is importable before adopting an interpreter, so the hook stops silently no-opping under that install (#2852, thanks @​santhiprakash).
• Fix: re-exporting into an Obsidian vault created before the ownership manifest existed now adopts graphify's own notes (recognized by their graphify/ frontmatter tag or community markers) instead of orphaning them beside a fresh generation (#2863, thanks @​abhay-codes07).
• Fix: the tsconfig/jsconfig alias and baseUrl caches are now cleared per extraction run, so an edit to compilerOptions.paths or baseUrl is picked up on the next graphify watch / MCP rebuild instead of resolving imports through a stale alias map for the life of the process (#2917, thanks @​sashankh).
• Fix: the C# extractor now emits references edges for types used as generic arguments — both at call sites (repo.Get<User>(), services.AddSingleton<IFoo, Foo>()) and in field declarations (private List<Order> _orders) — so generic calls and field-injected dependencies are no longer invisible; built-in and type-parameter types are not fabricated (#2911, thanks @​santhiprakash and @​brobl2008).
• Fix: oversized PDFs are now sliced through their text converter and their token count is estimated from the extracted text rather than the raw container, so a large paper no longer loses everything past the character cap or gets mis-sized by its binary bytes; slicing (including the adaptive-retry bisection) indexes the same extracted text the prompt carries (#2903, #2906, thanks @​abhay-codes07).
• Fix: every text document type is now sliced when oversized, not just five suffixes, so a large .qmd / .skill / .html / .yaml / .yml is no longer silently truncated at the character cap (#2900, thanks @​abhay-codes07).

Changelog

Sourced from graphifyy's changelog.

0.9.51 (2026-08-28)

• Fix: the incomplete-build shrink guard now stays armed when a chunk came back hollow, unparseable, or omitting files, so a run that silently lost content can no longer overwrite the existing graph with a smaller one; a complete run and a retry-recovered chunk are unaffected, and --allow-partial still overrides (#3105, thanks @​abhay-codes07).
• Fix: graphify extract --force --code-only now fully rescans code (instead of skipping unchanged files and keeping stale import/alias resolution) while still carrying the existing document/semantic tier forward (#3125, thanks @​hopstreax).
• Fix: a hyperedge carried from a prior graph.json now has its members routed through the dedup survivor remap, so it no longer dangles when one of its members is merged away; an unresolvable member is dropped gracefully (#3102, thanks @​abhay-codes07).
• Fix: the cache's atexit stat-index flush no longer recreates a graphify-out/ tree that was deleted during the run, so a removed corpus stays removed (#2974, thanks @​abhay-codes07).
• Fix: Leiden clustering canonicalizes undirected edge endpoints before sorting, so community assignments no longer drift across builds or machines from networkx yielding an edge's endpoints in a different order (thanks @​ErichKinuya).
• Fix: a TypeScript/JavaScript new Foo() now emits a calls edge to the constructed class (member, chained, and generic forms), so constructor usage is visible; built-in globals like new Map() / new Promise() are not fabricated (#3116, thanks @​hopstreax).
• Fix: an Elixir function whose only clause carries a when guard (def foo(x) when is_integer(x), do: ...) is now extracted, not dropped; multi-clause, multi-condition guards, and defp are handled (#3111, thanks @​santhiprakash).
• Fix: Common Lisp node ids are now derived from the full path stem like every other extractor, so two same-basename .lisp files in different directories no longer collide on merge (thanks @​guitelesc).
• Perf: Leiden clustering now calls the graspologic_native binding directly instead of importing the full graspologic package, avoiding its heavy import chain (umap / pynndescent / numba JIT); clustering output is unchanged, and it falls back to the graspologic wrapper and then NetworkX Louvain when the native binding is absent (#3104, thanks @​Mohammad-Palla).
• Docs: the README now documents the git workflow for keeping the graph in sync — commits and branch switches rebuild automatically via the installed hooks, while git pull / git merge need a manual graphify update . (thanks @​Mohammad-Palla).

0.9.50 (2026-08-25)

• Fix: Ruby methods whose names end in !, ?, or = now keep distinct node ids, so save and save! (or foo and foo=) no longer collide into one node; the label keeps the raw spelling and member-call resolution still matches (#3077, thanks @​hopstreax).
• Fix: a Ruby call on a qualified constant receiver (ActiveRecord::Base.transaction) now matches the receiver's full constant path, so it no longer binds to an unrelated lone class named Base; an edge is emitted only on a single unambiguous match (#3078, thanks @​rohit-jsfreaky).
• Fix: a CommonJS member export wrapped in a higher-order function (exports.x = wrap(fn), module.exports.y = onCall({...}, handler)) is now captured, reaching through the wrapper to the function it wraps without fabricating the wrapper as the export's identity (#3035, thanks @​hopstreax).
• Fix: graphify merge-graphs now offsets each input's community ids so community 0 of one repo no longer fuses with community 0 of another; within-input structure is preserved and the original id is kept in local_community (#3014, thanks @​santhiprakash).
• Fix: a .graphify_root marker written by Windows PowerShell (which prepends a UTF-8 BOM) no longer breaks hook rebuilds or silently mis-roots a scan; PowerShell now writes the marker BOM-less and every reader decodes BOM-tolerantly (#3028, thanks @​rohit-jsfreaky).
• Perf: ignore-pattern evaluation no longer builds a Path and calls relative_to per pattern per file — it computes the relative path lexically in string space, parses each pattern once into a bounded process cache, and memoizes per-entry work; ignore decisions are unchanged (differential-fuzz verified) and a pattern-heavy monorepo scans dramatically faster (#2226, thanks @​Azeem1985). The **-aware matcher was also lifted out of a per-call cache closure that leaked a reference cycle each call.
• Feature: C# and TypeScript enum members now each emit a graph node with a case_of edge to their enum (matching the existing Java/Kotlin/Swift enum handling), so an enum case is visible as a member; explicit and implicit values, const enum, and quoted TypeScript member names are all handled and no built-in types are fabricated (#3063, #3064, thanks @​durmazoguzhan).
• Fix: graphify watch no longer re-triggers on its own reads — read-only inotify events (opened, closed_no_write, emitted by the watcher's own AST rebuild) are dropped, while close-after-write and create/modify/move/delete still trigger; a no-op on the macOS/Windows backends that never emit them (thanks @​Azeem1985).
• Fix: pip install graphifyy[postgres] now carries the tree-sitter-sql grammar the introspection path needs, and a missing or ABI-incompatible grammar raises an actionable error instead of silently returning zero nodes (thanks @​Azeem1985).

0.9.49 (2026-08-24)

• Feature: graphify merge-graphs now links a type declaration that two repos share — same fully-qualified namespace and name, from different repos — with a same_type_as edge, so a shared contract type is navigable across the repo boundary; two unrelated types that merely share a short name are not linked (#3007, thanks @​durmazoguzhan).
• Feature: C# properties now emit a member node per property, so a property is visible as a class member alongside fields and methods; the property's type still emits its references edge and no built-in types are fabricated (#3006, thanks @​durmazoguzhan).
• Fix: when a C/C++/Objective-C declaration and its definition merge into one node, the node now points at the definition site (the implementation body) instead of the header prototype; the pick is deterministic regardless of file order, and a declaration with no definition keeps its own site (#2990, thanks @​winesoft-namjin-yun).
• Fix: a bash command substitution on the right of an assignment (x=$(fn)) now emits a calls edge like a bare $(fn), while argument-position and process substitutions stay suppressed (#2978, thanks @​akshitj11).
• Fix: a SQL CREATE TABLE wrapped in a BEGIN/COMMIT transaction is now extracted, not just top-level DDL (#2953, thanks @​akshitj11).
• Feature: C# object-creation expressions (new Foo()) now emit a calls edge to the constructed type, so constructor usage is visible in the graph; built-in and out-of-corpus types are not fabricated and a qualified construction resolves against declared namespaces (#2997, thanks @​durmazoguzhan).
• Feature: when a C# interface has exactly one implementing class, its methods are now linked to that implementation with a dispatches_to edge, so a call through an injected dependency reaches the implementation; guarded against false links (single implementer, single case-sensitively same-named method, both ends C#) (#3003, thanks @​durmazoguzhan).
• Fix: Zig methods declared on enums and unions (not just structs) are now extracted, along with the calls in their bodies (#2999, thanks @​rajatnagda45).
• Fix: a Julia abstract type declared with a supertype (abstract type Dog <: Animal end) is now extracted with its inherits edge instead of being dropped (#3000, thanks @​rajatnagda45).
• Fix: a Common Lisp defclass whose superclass lives in another file now keeps its inherits edge — the cross-file base is a sourceless stub that the corpus rewire collapses onto the real definition (#3001, thanks @​rajatnagda45).
• Fix: PowerShell enum definitions and their members are now extracted as a real sourced node, so a [Color] type reference resolves to the enum instead of a phantom stub (#3002, thanks @​rajatnagda45).
• Fix: a semantic result with no nodes and no hyperedges is no longer cached and stamped into the manifest, so an empty or degenerate LLM reply for a file no longer freezes it out of future re-dispatch; an existing manifest carrying such a stamp is healed by re-queueing those files (#2927, thanks @​hopstreax).
• Fix: fresh semantic results are now scoped to the files actually dispatched before they reach the graph merge, so a stray fragment the model misattributes to a non-dispatched file can no longer replace that file's prior contribution (this also silences the "skipped out-of-scope source_file" warning) (#2926, thanks @​SinghAman21).
• Fix: graphify extract --code-only --force over an existing graph now preserves the document/paper/image semantic layer instead of dropping it; files deleted from disk are still pruned (#2923, thanks @​santhiprakash).
• Fix: a class that inherits from a built-in base (e.g. PHP extends \Exception) no longer collapses onto a same-named class in another language, so a PHP+TypeScript monorepo stops growing a phantom cross-language inheritance edge / god node; same-language inheritance and user classes named like a built-in still link (#2812, thanks @​ousamabenyounes).
• Fix: the git post-commit hook now resolves graphify when it is installed as a uv tool, by scanning the uv tool locations after the pin and launcher probes miss and verifying graphify is importable before adopting an interpreter, so the hook stops silently no-opping under that install (#2852, thanks @​santhiprakash).
• Fix: re-exporting into an Obsidian vault created before the ownership manifest existed now adopts graphify's own notes (recognized by their graphify/ frontmatter tag or community markers) instead of orphaning them beside a fresh generation (#2863, thanks @​abhay-codes07).
• Fix: the tsconfig/jsconfig alias and baseUrl caches are now cleared per extraction run, so an edit to compilerOptions.paths or baseUrl is picked up on the next graphify watch / MCP rebuild instead of resolving imports through a stale alias map for the life of the process (#2917, thanks @​sashankh).
• Fix: the C# extractor now emits references edges for types used as generic arguments — both at call sites (repo.Get<User>(), services.AddSingleton<IFoo, Foo>()) and in field declarations (private List<Order> _orders) — so generic calls and field-injected dependencies are no longer invisible; built-in and type-parameter types are not fabricated (#2911, thanks @​santhiprakash and @​brobl2008).
• Fix: oversized PDFs are now sliced through their text converter and their token count is estimated from the extracted text rather than the raw container, so a large paper no longer loses everything past the character cap or gets mis-sized by its binary bytes; slicing (including the adaptive-retry bisection) indexes the same extracted text the prompt carries (#2903, #2906, thanks @​abhay-codes07).
• Fix: every text document type is now sliced when oversized, not just five suffixes, so a large .qmd / .skill / .html / .yaml / .yml is no longer silently truncated at the character cap (#2900, thanks @​abhay-codes07).

Commits

• 281ccaa chore: bump to 0.9.51
• 982a09f docs(changelog): add 0.9.51 entries for the shrink-guard/force-rescan/hypered...
• ae074b2 fix(extract): rescan code with --force --code-only (#3125)
• a8852e8 fix(extract): hollow, unparseable and omitting chunks count as incomplete (#3...
• 3378ae8 fix(build): route carried hyperedges through the dedup survivor remap (#3102)
• bad832f test(cluster): pin partition invariance to edge-endpoint orientation (#3146)
• 2709681 fix(cluster): canonicalise edge endpoints before sorting in _partition
• c60ddf7 fix(cache): the atexit stat-index flush must not resurrect a deleted corpus (...
• 384e71e docs(changelog): add 0.9.51 entries for the ts-new/elixir-guard/commonlisp-id...
• 590258f fix(ts): resolve new_expression constructor calls (#3116)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bifrost0x]

Superseded by #170, which consolidates this update with the other August dependency pull requests and includes regenerated hash-locked Python lock files plus complete local verification.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml