Skip to content

chore(deps): bump the python-deps group across 1 directory with 28 updates - #2810

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/dev/python-deps-cc2449b111
Open

chore(deps): bump the python-deps group across 1 directory with 28 updates#2810
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/dev/python-deps-cc2449b111

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-deps group with 28 updates in the / directory:

Package From To
lxml 6.1.2 6.1.3
readability-lxml 0.8.4.1 0.9
websockets 15.0.1 17.1
pywebpush 2.4.0 2.5.0
zeroconf 0.150.0 0.151.3
filelock 3.29.4 3.32.5
packaging 26.2 26.3
litellm 1.94.2 1.99.0
apscheduler 3.11.2 3.11.3
azure-storage-blob 12.30.0 12.30.1
boto3 1.43.29 1.43.87
expression 5.6.0 5.7.0
fastapi-sso 0.21.0 0.22.0
granian 2.7.6 2.8.2
gunicorn 23.0.0 26.2.0
litellm-proxy-extras 0.4.79.post2 0.4.92
mcp 1.28.1 2.1.1
orjson 3.11.9 3.12.0
polars 1.41.2 1.44.1
pydantic-settings 2.14.2 2.15.0
pyroscope-io 0.8.16 1.2.1
restrictedpython 8.3 8.5
rich 13.9.4 15.0.0
rq 2.9.1 2.12.0
soundfile 0.12.1 0.14.0
starlette 1.3.1 1.6.0
uvicorn 0.52.1 0.52.4
uvloop 0.21.0 0.22.1

Updates lxml from 6.1.2 to 6.1.3

Changelog

Sourced from lxml's changelog.

6.1.3 (2026-09-02)

Bugs fixed

  • LP#2165901: External parameter entity parsing was allowed by default (with resolve_entities="internal"). Issue found by Tomer Fichman.
Commits
  • 3c1a4c7 Prepare release of 6.1.3.
  • c1191fc Update changelog.
  • 03ec312 Disable parameter entity parsing when internal-only entity parsing is requested.
  • 11d03e9 Build: Prevent duplicate Py3.8 wheel builds.
  • 9efc586 Build: Exclude musllinux-ARM from Py3.8 wheel building to prevent slow emulat...
  • 9716fb1 Build: Include older PyPy versions.
  • 0f3327d Build: Exclude Win-Aarch64 from wheel build.
  • 6967c96 Build: Make all built wheels downloadable even if they don't pass the release...
  • 061218d Build: Exclude Py3.15 i686 wheels from validation (because they are intention...
  • ce9fe0d Build: Fix Py3.8 windows build.
  • See full diff in compare view

Updates readability-lxml from 0.8.4.1 to 0.9

Release notes

Sourced from readability-lxml's releases.

0.9

Python Readability 0.9 adds Python 3.14 and lxml 6 support, fixes bytes input and encoding handling, improves extraction of segmented and inline-formatted articles, strengthens active-content removal, modernizes packaging and release checks, and adds reproducible quality corpora and comparisons.

Quality evaluation: in a reproducible comparison of ten extraction engines on 181 saved pages, Readability 0.9 ranks #2 overall with F1 0.975. On the 51 pages outside Mozilla Readability’s own fixture corpus, it ranks #1 with F1 0.975. Mozilla Readability ranks #1 overall with F1 0.986, but 130 of the 181 fixtures come from its test suite. The full quality evaluation includes the corpus, methodology, complete results, failures, and per-page measurements.

The 166-page release benchmark reaches precision 0.991, recall 0.956, and F1 0.973. Fixes #14, #108, #119, #130, #143, #146, #153, #158, #159, #163, #170, #176, #182, #194, and #196.

Commits

Updates websockets from 15.0.1 to 17.1

Release notes

Sourced from websockets's releases.

17.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

17.0.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

17.0

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

16.1.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

16.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

16.0

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • e87ea9b Release version 17.1.
  • caf68ab Minor whitespace normalization.
  • f4c73b7 Accept pathlib.Path objects in path arguments.
  • b1e4a14 Clarify when the new asyncio implementation became the default.
  • c7cc7ed Move process_exception to the Sans-I/O layer.
  • 2543503 Support reconnecting in the threading implementation.
  • 1c8fb09 Follow redirects in the sync implementation.
  • 1f7f0e5 Deprecate calling connect() directly.
  • c06d5c5 Support overriding host/post in the sync client.
  • 885e69b Add tests for connecting without a context manager.
  • Additional commits viewable in compare view

Updates pywebpush from 2.4.0 to 2.5.0

Changelog

Sourced from pywebpush's changelog.

2.5.0

  • Add common status_code and retry_after accessors to WebPushException for synchronous and asynchronous responses.

2.3.0 (2026-02-09)

  • Cleanup from @​Rotzbua
    • Use modern typing for annotations
    • Remove legacy python 2 import
    • remove redundant :type annotations
    • use [.dev] extras in CI

2.2.1 (2026-02-06)

2.2.0 (2026-)

  • Update rst files to reflect md file changes

Add comment discussing additional work for Windows Notification Service (WNS)

  • Update the README.md file to mention the required, non-standard headers.

BREAKING_CHANGE This version also drops legacy support for GCM/FCM authorization keys, since those items are obsolete according to Google. See https://firebase.google.com/docs/cloud-messaging/auth-server#authorize-legacy-protocol-send-requests

2.1.2 (2025-11-10)

chore: fix formatting chore: update CHANGELOG chore: note admin update

2.1.1 (2025-10-14)

This was an administrative push to test a new publication system.

2.1.0 (2025-09-29)

feat: Add a async_webpush one call func and tests (15cf848)[https://github.com/web-push-libs/pywebpush/commit/15cf84885b4bc1cd4e8e58a8fc8f84bfc9b3387e] (thanks (@​AlexUnder2003)[https://github.com/web-push-libs/pywebpush/commits?author=AlexUnder2003])

2.0.1 (2024-10-14)

docs: Use License classifiers in pyproject.toml (thanks @​sevdog)

2.0.0 (2024-01-02)

... (truncated)

Commits

Updates zeroconf from 0.150.0 to 0.151.3

Release notes

Sourced from zeroconf's releases.

0.151.3

v0.151.3 (2026-08-30)

This release is published under the LGPL-2.1-or-later License.

Bug Fixes

  • Correct the recursion available header flag to the rfc 1035 value (#1893, 07e3812)

Refactoring

  • Compute probe pacing from fresh clock reads (#1888, 7737108)

  • Compute service info request pacing from fresh clock reads (#1895, 49aa15f)

Testing

  • Fix flaky test_service_browser_expire_callbacks (#1879, 6d061a4)

  • Make test_qu_response deterministic by injecting the announcement (#1845, 10db10a)

Detailed Changes: 0.151.2...0.151.3

0.151.2

v0.151.2 (2026-08-29)

This release is published under the LGPL-2.1-or-later License.

Bug Fixes

  • Restore sdist contents and listener typing after the reverts (#1839, 6b2a040)

Detailed Changes: 0.151.1...0.151.2

0.151.1

v0.151.1 (2026-08-28)

This release is published under the LGPL-2.1-or-later License.

Bug Fixes

  • Accept str addresses in ServiceInfo.addresses under cython (#1836, c0b2d50)

Detailed Changes: 0.151.0...0.151.1

... (truncated)

Changelog

Sourced from zeroconf's changelog.

v0.151.3 (2026-08-30)

Bug Fixes

  • Correct the recursion available header flag to the rfc 1035 value (#1893, 07e3812)

Refactoring

  • Compute probe pacing from fresh clock reads (#1888, 7737108)

  • Compute service info request pacing from fresh clock reads (#1895, 49aa15f)

Testing

  • Fix flaky test_service_browser_expire_callbacks (#1879, 6d061a4)

  • Make test_qu_response deterministic by injecting the announcement (#1845, 10db10a)

v0.151.2 (2026-08-29)

Bug Fixes

  • Restore sdist contents and listener typing after the reverts (#1839, 6b2a040)

v0.151.1 (2026-08-28)

Bug Fixes

  • Accept str addresses in ServiceInfo.addresses under cython (#1836, c0b2d50)

v0.151.0 (2026-08-28)

Features

... (truncated)

Commits
  • b7aea22 0.151.3
  • 07e3812 fix: correct the recursion available header flag to the rfc 1035 value (#1893)
  • 49aa15f refactor: compute service info request pacing from fresh clock reads (#1895)
  • b110640 chore: regenerate the incoming field order and retire remaining 2009 fingerpr...
  • d5f4102 chore: drop the equality docstring family and reword the cache lookup docstri...
  • 25f564a chore: fix the stale fallback comment and reword docstrings flagged by the ei...
  • cc92a76 chore: rework the remaining echoes flagged by the seventh independent audit (...
  • 7737108 refactor: compute probe pacing from fresh clock reads (#1888)
  • bfc1af2 chore: rework the remaining shapes flagged by the sixth independent audit (#1...
  • ae524a5 chore(deps-dev): bump setuptools from 83.0.0 to 84.0.0 (#1814)
  • Additional commits viewable in compare view

Updates filelock from 3.29.4 to 3.32.5

Release notes

Sourced from filelock's releases.

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

3.32.4

What's Changed

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

3.32.2

What's Changed

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits
  • 1585dfe Release 3.32.5
  • 00177c3 🐛 fix(lease): clear token after failed acquire (#721)
  • 5aeb9b6 📝 docs: say that mode is read-only in the thread-local section (#716)
  • 2634dd1 [pre-commit.ci] pre-commit autoupdate (#720)
  • 37dccf0 🧪 test(fork): report where a stalled fork stops (#715)
  • cb493d6 Release 3.32.4
  • fe07a11 escape the hostname every marker publishes (#709)
  • 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
  • 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
  • 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates litellm from 1.94.2 to 1.99.0

Release notes

Sourced from litellm's releases.

v1.99.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.99.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • fa647f7 Merge pull request #39048 from BerriAI/litellm_/docker-build-failure-9f6247
  • 5892e30 fix(docker): pin apk python to 3.13 in migrations image
  • 91f1a57 fix(docker): bump wolfi-base for glibc 2.44 and pin apk python to 3.13
  • d0c8667 Merge pull request #38862 from BerriAI/litellm_/litellm-e2e-rc-1-99-0-11cfd8
  • da1d292 test(e2e): measure the select popup after it settles instead of mid-flight
  • a2aecfe fix(e2e): only the negative fallback assertion needs every replica to agree
  • ab1da05 test(e2e): de-flake the cost-header cache read and the router fallback control
  • 1411852 Merge pull request #38855 from BerriAI/litellm_/backport-38251-rc-1-99-0
  • f0ee067 fix(anthropic): translate tool_result document blocks in the /v1/messages bridge
  • 4b281e7 Merge pull request #38854 from BerriAI/litellm_backport_model_test_dialog_str...
  • Additional commits viewable in compare view

Updates apscheduler from 3.11.2 to 3.11.3

Release notes

Sourced from apscheduler's releases.

3.11.3

  • Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#1103)
  • Fixed imported jobs missing their scheduler and job store links (#1119)
Commits
  • 4308ec9 Added the release version
  • ff68780 Added a note about weekday numbers in CronTrigger.from_crontab()
  • 36936e9 Updated actions
  • c0ff7e4 Fixed Pyside6 tests failing on Python 3.9 and 3.8
  • 1b782c9 Fixed fixture coreapp not found
  • dc3dde4 Test against PySide6 on all Python versions
  • 18a6f6b Fixed imported jobs missing their scheduler and job store links
  • 1693db4 Fix interval jobs stalling across DST spring-forward with ZoneInfo (#1114)
  • 0636bf4 Added Python 3.14 to the test matrix
  • 3eb3de8 Fixed bad use of pytest.raises()
  • Additional commits viewable in compare view

Updates azure-storage-blob from 12.30.0 to 12.30.1

Release notes

Sourced from azure-storage-blob's releases.

azure-storage-blob_12.30.1

12.30.1 (2026-08-24)

Bugs Fixed

  • Fixed a bug where client-side encryption 2.0 could not detect a rearrangement of otherwise-untampered authenticated regions in blob content. This is now detected and exceptions are thrown. For data recovery purposes, this behavior can be reverted by setting the "AZURE_STORAGE_CSE_V2_ALLOW_MISORDERED_AUTH_REGIONS" environment variable.
  • Fixed a bug in client-side encryption where version downgrades, and other metadata tampering, was only detected at the start of a download.
Commits

Updates boto3 from 1.43.29 to 1.43.87

Commits
  • d5740c2 Merge branch 'release-1.43.87'
  • 316b72c Bumping version to 1.43.87
  • 17409b4 Add changelog entries from botocore
  • 81ae047 Merge branch 'release-1.43.86'
  • 0e52e63 Merge branch 'release-1.43.86' into develop
  • 938cd05 Bumping version to 1.43.86
  • c20fb35 Add changelog entries from botocore
  • eec256a Merge branch 'release-1.43.85'
  • 11ef970 Merge branch 'release-1.43.85' into develop
  • 359c9b7 Bumping version to 1.43.85
  • Additional commits viewable in compare view

Updates expression from 5.6.0 to 5.7.0

Release notes

Sourced from expression's releases.

v5.7.0

See CHANGELOG.md for details.

Changelog

Sourced from expression's changelog.

5.7.0 - 2026-08-15

🚀 Features

🐞 Bug Fixes

  • Declare Read the Docs extensions (#263) (13e85ee)
  • Make map.Map and maptree.MapTree require keys to be hashable (#258) (8c19a1b)

View changes on Github

Commits

Updates fastapi-sso from 0.21.0 to 0.22.0

Release notes

Sourced from fastapi-sso's releases.

0.22.0

⚠️ Security fix and breaking change

This release fixes an OAuth login CSRF vulnerability (GHSA-wgrh-7h2j-rg46, CWE-352), reported by

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 6, 2026
@dependabot
chore(deps): bump the python-deps group across 1 directory with 28 up…
1353ac5 
…dates

Bumps the python-deps group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lxml](https://github.com/lxml/lxml) | `6.1.2` | `6.1.3` |
| [readability-lxml](https://github.com/buriy/python-readability) | `0.8.4.1` | `0.9` |
| [websockets](https://github.com/python-websockets/websockets) | `15.0.1` | `17.1` |
| [pywebpush](https://github.com/web-push-libs/pywebpush) | `2.4.0` | `2.5.0` |
| [zeroconf](https://github.com/python-zeroconf/python-zeroconf) | `0.150.0` | `0.151.3` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.4` | `3.32.5` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [litellm](https://github.com/BerriAI/litellm) | `1.94.2` | `1.99.0` |
| [apscheduler](https://github.com/agronholm/apscheduler) | `3.11.2` | `3.11.3` |
| [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python) | `12.30.0` | `12.30.1` |
| [boto3](https://github.com/boto/boto3) | `1.43.29` | `1.43.87` |
| [expression](https://github.com/cognitedata/Expression) | `5.6.0` | `5.7.0` |
| [fastapi-sso](https://github.com/tomasvotava/fastapi-sso) | `0.21.0` | `0.22.0` |
| [granian](https://github.com/emmett-framework/granian) | `2.7.6` | `2.8.2` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `26.2.0` |
| [litellm-proxy-extras](https://github.com/BerriAI/litellm) | `0.4.79.post2` | `0.4.92` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.1.1` |
| [orjson](https://github.com/ijl/orjson) | `3.11.9` | `3.12.0` |
| [polars](https://github.com/pola-rs/polars) | `1.41.2` | `1.44.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| pyroscope-io | `0.8.16` | `1.2.1` |
| [restrictedpython](https://github.com/zopefoundation/RestrictedPython) | `8.3` | `8.5` |
| [rich](https://github.com/Textualize/rich) | `13.9.4` | `15.0.0` |
| [rq](https://github.com/rq/rq) | `2.9.1` | `2.12.0` |
| [soundfile](https://github.com/bastibe/python-soundfile) | `0.12.1` | `0.14.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [uvloop](https://github.com/MagicStack/uvloop) | `0.21.0` | `0.22.1` |



Updates `lxml` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.2...lxml-6.1.3)

Updates `readability-lxml` from 0.8.4.1 to 0.9
- [Release notes](https://github.com/buriy/python-readability/releases)
- [Commits](buriy/python-readability@0.8.4.1...0.9)

Updates `websockets` from 15.0.1 to 17.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@15.0.1...17.1)

Updates `pywebpush` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/web-push-libs/pywebpush/releases)
- [Changelog](https://github.com/web-push-libs/pywebpush/blob/main/CHANGELOG.md)
- [Commits](https://github.com/web-push-libs/pywebpush/commits)

Updates `zeroconf` from 0.150.0 to 0.151.3
- [Release notes](https://github.com/python-zeroconf/python-zeroconf/releases)
- [Changelog](https://github.com/python-zeroconf/python-zeroconf/blob/master/CHANGELOG.md)
- [Commits](python-zeroconf/python-zeroconf@0.150.0...0.151.3)

Updates `filelock` from 3.29.4 to 3.32.5
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.4...3.32.5)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `litellm` from 1.94.2 to 1.99.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.94.2...v1.99.0)

Updates `apscheduler` from 3.11.2 to 3.11.3
- [Release notes](https://github.com/agronholm/apscheduler/releases)
- [Commits](agronholm/apscheduler@3.11.2...3.11.3)

Updates `azure-storage-blob` from 12.30.0 to 12.30.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.30.0...azure-storage-blob_12.30.1)

Updates `boto3` from 1.43.29 to 1.43.87
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.29...1.43.87)

Updates `expression` from 5.6.0 to 5.7.0
- [Release notes](https://github.com/cognitedata/Expression/releases)
- [Changelog](https://github.com/dbrattli/Expression/blob/main/CHANGELOG.md)
- [Commits](dbrattli/Expression@v5.6.0...v5.7.0)

Updates `fastapi-sso` from 0.21.0 to 0.22.0
- [Release notes](https://github.com/tomasvotava/fastapi-sso/releases)
- [Commits](tomasvotava/fastapi-sso@0.21.0...0.22.0)

Updates `granian` from 2.7.6 to 2.8.2
- [Release notes](https://github.com/emmett-framework/granian/releases)
- [Commits](emmett-framework/granian@v2.7.6...v2.8.2)

Updates `gunicorn` from 23.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...26.2.0)

Updates `litellm-proxy-extras` from 0.4.79.post2 to 0.4.92
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](https://github.com/BerriAI/litellm/commits)

Updates `mcp` from 1.28.1 to 2.1.1
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.1.1)

Updates `orjson` from 3.11.9 to 3.12.0
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.11.9...3.12.0)

Updates `polars` from 1.41.2 to 1.44.1
- [Release notes](https://github.com/pola-rs/polars/releases)
- [Commits](pola-rs/polars@py-1.41.2...py-1.44.1)

Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)

Updates `pyroscope-io` from 0.8.16 to 1.2.1

Updates `restrictedpython` from 8.3 to 8.5
- [Changelog](https://github.com/zopefoundation/RestrictedPython/blob/master/CHANGES.rst)
- [Commits](zopefoundation/RestrictedPython@8.3...8.5)

Updates `rich` from 13.9.4 to 15.0.0
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/main/CHANGELOG.md)
- [Commits](Textualize/rich@v13.9.4...v15.0.0)

Updates `rq` from 2.9.1 to 2.12.0
- [Release notes](https://github.com/rq/rq/releases)
- [Changelog](https://github.com/rq/rq/blob/master/CHANGES.md)
- [Commits](rq/rq@v2.9.1...v2.12)

Updates `soundfile` from 0.12.1 to 0.14.0
- [Release notes](https://github.com/bastibe/python-soundfile/releases)
- [Commits](bastibe/python-soundfile@0.12.1...0.14.0)

Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)

Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.1...0.52.4)

Updates `uvloop` from 0.21.0 to 0.22.1
- [Release notes](https://github.com/MagicStack/uvloop/releases)
- [Commits](MagicStack/uvloop@v0.21.0...v0.22.1)

---
updated-dependencies:
- dependency-name: apscheduler
  dependency-version: 3.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: azure-storage-blob
  dependency-version: 12.30.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: boto3
  dependency-version: 1.43.87
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: expression
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: fastapi-sso
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: filelock
  dependency-version: 3.32.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: granian
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: litellm
  dependency-version: 1.99.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: litellm-proxy-extras
  dependency-version: 0.4.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: mcp
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: orjson
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: polars
  dependency-version: 1.44.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pyroscope-io
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: pywebpush
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: readability-lxml
  dependency-version: '0.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: restrictedpython
  dependency-version: '8.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: rich
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: rq
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: soundfile
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: uvloop
  dependency-version: 0.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: websockets
  dependency-version: '17.1'
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: zeroconf
  dependency-version: 0.151.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/dev/python-deps-cc2449b111 branch from bb435a9 to 1353ac5 Compare September 6, 2026 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants