Skip to content

build: bump the python-minor-patch group across 1 directory with 6 updates - #24

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/python-minor-patch-1eda37ef63
Closed

build: bump the python-minor-patch group across 1 directory with 6 updates#24
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/python-minor-patch-1eda37ef63

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 6 updates in the / directory:

Package From To
fastmcp 3.4.2 3.4.5
diff-cover 10.3.0 10.4.1
import-linter 2.12 2.13
pre-commit 4.6.0 4.6.1
ruff 0.15.20 0.16.1
syrupy 5.4.0 5.5.3

Updates fastmcp from 3.4.2 to 3.4.5

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

... (truncated)

Changelog

Sourced from fastmcp's changelog.


title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

Docs 📚

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

  • Migrate to MCP Python SDK v2 by @​jlowin in #4437
  • Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
  • Forward-port Hugging Face auth provider by @​jlowin in #4475
  • Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483
  • Add guard-mode multi-round-trip tools (SEP-2322) by @​jlowin in #4544
  • Add FastMCP-native server extension API (SEP-2133) by @​jlowin in #4602
  • Add stateless session state (UserSession / SessionId) by @​jlowin in #4604
  • Add background tasks via the io.modelcontextprotocol/tasks extension (SEP-2663) by @​jlowin in #4603

Breaking Changes ⚠️

... (truncated)

Commits

Updates diff-cover from 10.3.0 to 10.4.1

Release notes

Sourced from diff-cover's releases.

Version 10.4.1

What's Changed

Dependencies

Full Changelog: Bachmann1234/diff_cover@v10.4.0...v10.4.1

Version 10.4.0

What's Changed

Dependency bumps

New Contributors

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Changelog

Sourced from diff-cover's changelog.

8/06/2026 v10.4.2

7/23/2026 v10.4.1

7/21/2026 v10.4.0

  • Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

  • Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

  • Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

01/08/2026 v10.2.0

12/30/2025 v10.1.0

  • Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

  • Remove python 3.9 support
  • Add python 3.14 support
  • Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

09/25/2025 v9.7.1

  • Revert the change to attempt to support ruff >=0.12.9 (@​YeeaahMan caught the error)

09/23/2025 v9.7.0

... (truncated)

Commits

Updates import-linter from 2.12 to 2.13

Changelog

Sourced from import-linter's changelog.

2.13 (2026-07-03)

  • Add module counts option to the explore UI and drawgraph command.
Commits

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Updates syrupy from 5.4.0 to 5.5.3

Release notes

Sourced from syrupy's releases.

v5.5.3

What's Changed

This release has no functional changes. It just fixes an issue where the release tag pointed to the previous commit instead of the commit with the updated pyproject.toml (see syrupy-project/syrupy#1144).

Full Changelog: syrupy-project/syrupy@v5.5.2...v5.5.3

v5.5.2

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.1...v5.5.2

v5.5.1

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.0...v5.5.1

v5.5.0

What's Changed

NOTE: Test suites using pytest-xdist that previously passed due to incomplete snapshot support may now fail if unused snapshots are detected. You can use --snapshot-warn-unused to downgrade unused snapshot detection from an error to a warning though it's not recommended.

Full Changelog: syrupy-project/syrupy@v5.4.0...v5.5.0

Changelog

Sourced from syrupy's changelog.

v5.5.3 (2026-07-11)

What's Changed

Full Changelog: syrupy-project/syrupy@v5.5.2...v5.5.3

v5.5.2 (2026-07-08)

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.1...v5.5.2

v5.5.1 (2026-07-06)

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.0...v5.5.1

v5.5.0 (2026-07-06)

What's Changed

NOTE: Test suites using pytest-xdist that previously passed due to incomplete snapshot support may now fail if unused snapshots are detected. You can use --snapshot-warn-unused to downgrade unused snapshot detection from an error to a warning though it's not recommended.

Full Changelog: syrupy-project/syrupy@v5.4.0...v5.5.0

Commits
  • 3cd3473 chore(release): 5.5.3 [skip ci]
  • fed7e9f chore(deps): update astral-sh/setup-uv action to v8.3.2 (#1149)
  • 443fc11 chore: closes #1144 (#1146)
  • 56bf157 chore(deps): update dependency hypothesis to v6.156.3 (#1150)
  • f9c725a chore(deps): update dependency mypy to v2.2.0 (#1148)
  • 3af2ccf chore(deps): update dependency hypothesis to v6.156.2 (#1147)
  • feaa22c chore(deps): update astral-sh/setup-uv action to v8.3.1 (#1145)
  • 5c59701 chore(deps): update astral-sh/setup-uv action to v8.3.0 (#1143)
  • 1cbf716 chore(release): 5.5.2 [skip ci]
  • 4f83490 fix: Fix detecting pytest-xdist when loaded via PYTEST_PLUGINS (#1142)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates

Bumps the python-minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.2` | `3.4.5` |
| [diff-cover](https://github.com/Bachmann1234/diff-cover) | `10.3.0` | `10.4.1` |
| [import-linter](https://github.com/seddonym/import-linter) | `2.12` | `2.13` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.1` |
| [syrupy](https://github.com/syrupy-project/syrupy) | `5.4.0` | `5.5.3` |



Updates `fastmcp` from 3.4.2 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.2...v3.4.5)

Updates `diff-cover` from 10.3.0 to 10.4.1
- [Release notes](https://github.com/Bachmann1234/diff-cover/releases)
- [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG)
- [Commits](Bachmann1234/diff_cover@v10.3.0...v10.4.1)

Updates `import-linter` from 2.12 to 2.13
- [Changelog](https://github.com/seddonym/import-linter/blob/main/docs/release_notes.md)
- [Commits](seddonym/import-linter@v2.12...v2.13)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `ruff` from 0.15.20 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.1)

Updates `syrupy` from 5.4.0 to 5.5.3
- [Release notes](https://github.com/syrupy-project/syrupy/releases)
- [Changelog](https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md)
- [Commits](syrupy-project/syrupy@v5.4.0...v5.5.3)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: diff-cover
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: import-linter
  dependency-version: '2.13'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: syrupy
  dependency-version: 5.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates python Python code labels Aug 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 14, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-patch-1eda37ef63 branch August 14, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates python Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants