Bump the python-packages group across 1 directory with 15 updates

[dependabot]

Bumps the python-packages group with 15 updates in the / directory:

Package	From	To
anyio	4.14.1	4.14.2
pydocket	0.22.0	0.23.1
exa-py	2.15.0	2.16.2
tavily-python	0.7.26	0.7.27
markdownify	1.2.2	1.2.3
inline-snapshot	0.34.2	0.35.3
diff-cover	10.3.0	10.4.1
pip	26.1.2	26.2
genai-prices	0.1.0	0.1.1
fastmcp	3.4.2	3.4.5
mypy	2.1.0	2.3.0
ruff	0.15.19	0.16.1
algoliasearch	4.44.1	4.44.4
logfire	4.37.0	4.39.0
logfire-api	4.37.0	4.39.0

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates pydocket from 0.22.0 to 0.23.1

Release notes

Sourced from pydocket's releases.

0.23.1 - Sharing is caring

What's Changed

• Share ssl_* options with the Sentinel daemon connections on TLS URLs by @​fatih-acar in chrisguidry/docket#445
• Bump the all-dependencies group across 1 directory with 19 updates by @​dependabot[bot] in chrisguidry/docket#447
• Confirm subscriptions before ready; bound TCP connects by @​chrisguidry in chrisguidry/docket#448

Full Changelog: chrisguidry/docket@0.23.0...0.23.1

0.23.0 - Out of Many, One

What's Changed

• Bump starlette from 1.2.1 to 1.3.1 by @​dependabot[bot] in chrisguidry/docket#434
• Bump the all-dependencies group with 5 updates by @​dependabot[bot] in chrisguidry/docket#433
• Bump the all-dependencies group with 6 updates by @​dependabot[bot] in chrisguidry/docket#436
• Bump actions/checkout from 6 to 7 in the all-actions group by @​dependabot[bot] in chrisguidry/docket#435
• Re-seed automatic perpetuals so a severed chain heals without a restart by @​chrisguidry in chrisguidry/docket#438
• Tie worker liveness to claim-ready processing by @​desertaxle in chrisguidry/docket#440
• Add a batch scheduling API: call() + add_many()/replace_many() by @​bunchesofdonald in chrisguidry/docket#443

Full Changelog: chrisguidry/docket@0.22.0...0.23.0

Commits

• 733772c Confirm subscriptions before ready; bound TCP connects (#448)
• 457830d Bump the all-dependencies group across 1 directory with 19 updates (#447)
• 1a99d82 Share ssl_* options with the Sentinel daemon connections on TLS URLs (#445)
• d7979ab Add a batch scheduling API: call() + add_many()/replace_many() (#443)
• 67f9394 Tie worker liveness to claim-ready processing (#440)
• 24d7ce3 Re-seed automatic perpetuals so a severed chain heals without a restart (#438)
• dffda50 Bump actions/checkout from 6 to 7 in the all-actions group (#435)
• 9a75908 Bump the all-dependencies group with 6 updates (#436)
• 42f6bc0 Bump the all-dependencies group with 5 updates (#433)
• 5d2722d Bump starlette from 1.2.1 to 1.3.1 (#434)
• See full diff in compare view

Updates exa-py from 2.15.0 to 2.16.2

Updates tavily-python from 0.7.26 to 0.7.27

Commits

• See full diff in compare view

Updates markdownify from 1.2.2 to 1.2.3

Release notes

Sourced from markdownify's releases.

1.2.3

What's Changed

• fix: allow None to be used for strip_pre and warp_width params in types by @​G-Rath in matthewwithanm/python-markdownify#257
• fix: preserve text nested inside <br> by html.parser (#244) by @​gaoflow in matthewwithanm/python-markdownify#264

New Contributors

• @​gaoflow made their first contribution in matthewwithanm/python-markdownify#264

Full Changelog: matthewwithanm/python-markdownify@1.2.2...1.2.3

Commits

• 9341855 Merge branch 'develop'
• bc98c9e bump to version v1.2.3
• dd5728e fix: preserve text nested inside <br> by html.parser (#264)
• 0b359c0 fix: allow None to be used for strip_pre and warp_width params in types...
• See full diff in compare view

Updates inline-snapshot from 0.34.2 to 0.35.3

Release notes

Sourced from inline-snapshot's releases.

0.35.3

Added

• Added Builder.create_set() for creating set expressions in customization functions.

Fixed

• Fixed set snapshot serialization to be deterministic for partially ordered values such as incomparable frozenset members.

• Fixed a crash when an unknown --inline-snapshot flag is provided, without running report finalization or modifying external snapshot tracking files.

0.35.2

Fixed

• fix passing PYTHONPATH, PYTHONWARNINGS, and PYTHONDONTWRITEBYTECODE while running the test suite.

0.35.1

Fixed

• fix passing PYTEST_DISABLE_PLUGIN_AUTOLOAD and PYTEST_PLUGINS while running the test suite.

0.35.0

Changed

• inline-snapshot now tracks source files that use external() in .inline-snapshot/files_using_external.txt (inside storage-dir) and uses this tracked list to detect and trim unused external snapshots.

• The tool.inline-snapshot.test-dir configuration option is only used as a compatibility fallback when files_using_external.txt does not exist yet.

• Documentation examples now use rich terminal snapshots to show pytest output with colors and formatting.

Changelog

Sourced from inline-snapshot's changelog.

0.35.3 — 2026-07-27

Added

• Added Builder.create_set() for creating set expressions in customization functions.

Fixed

• Fixed set snapshot serialization to be deterministic for partially ordered values such as incomparable frozenset members.

• Fixed a crash when an unknown --inline-snapshot flag is provided, without running report finalization or modifying external snapshot tracking files.

0.35.2 — 2026-07-16

Fixed

• fix passing PYTHONPATH, PYTHONWARNINGS, and PYTHONDONTWRITEBYTECODE while running the test suite.

0.35.1 — 2026-07-16

Fixed

• fix passing PYTEST_DISABLE_PLUGIN_AUTOLOAD and PYTEST_PLUGINS while running the test suite.

0.35.0 — 2026-07-15

Changed

• inline-snapshot now tracks source files that use external() in .inline-snapshot/files_using_external.txt (inside storage-dir) and uses this tracked list to detect and trim unused external snapshots.

• The tool.inline-snapshot.test-dir configuration option is only used as a compatibility fallback when files_using_external.txt does not exist yet.

• Documentation examples now use rich terminal snapshots to show pytest output with colors and formatting.

Commits

• 4485eac bump: version 0.35.2 → 0.35.3
• 25a937a fix: Handle unknown --inline-snapshot flags without session-finish `Asserti...
• 9ec2ed9 fix: Make set snapshot serialization deterministic for partial-order elements...
• ffa62b6 bump: version 0.35.1 → 0.35.2
• ee80c1c fix: Pass PYTHONPATH etc. to test environment (#379)
• c3c9454 bump: version 0.35.0 → 0.35.1
• bf42325 fix: Pass pytest plugin control variables to test environment (#378)
• 0dd6d93 bump: version 0.34.2 → 0.35.0
• d587238 style: pre-commit autoupdate (#291)
• cfdc856 docs: update docs (#377)
• Additional commits viewable in compare view

Updates diff-cover from 10.3.0 to 10.4.1

Release notes

Sourced from diff-cover's releases.

Version 10.4.1

What's Changed

• Handle low confidence chardet detection for undeclared encodings by @​Bachmann1234 in Bachmann1234/diff_cover#611

Dependencies

• Bump setuptools from 80.9.0 to 83.0.0 by @​dependabot[bot] in Bachmann1234/diff_cover#609

Full Changelog: Bachmann1234/diff_cover@v10.4.0...v10.4.1

Version 10.4.0

What's Changed

• Add --branch-coverage flag to respect partial branch coverage by @​mofr in Bachmann1234/diff_cover#608

Dependency bumps

• Bump ruff from 0.15.12 to 0.15.15 by @​dependabot[bot] in Bachmann1234/diff_cover#602
• Bump black from 26.3.1 to 26.5.1 by @​dependabot[bot] in Bachmann1234/diff_cover#603
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in Bachmann1234/diff_cover#604
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in Bachmann1234/diff_cover#605
• Bump ruff from 0.15.15 to 0.15.20 by @​dependabot[bot] in Bachmann1234/diff_cover#606
• Bump pylint from 4.0.5 to 4.0.6 by @​dependabot[bot] in Bachmann1234/diff_cover#607

New Contributors

• @​mofr made their first contribution in Bachmann1234/diff_cover#608

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Changelog

Sourced from diff-cover's changelog.

8/08/2026 v10.5.0

• Support PHPUnit clover reports (PR 617)[https://redirect.github.com/Support PHPUnit clover reports (silently reported as zero coverage) Bachmann1234/diff_cover#617] Thanks @​Eljees

8/06/2026 v10.4.2

• Honor format option from config file- (PR 612)[https://redirect.github.com/fix(config): honor format option from config file Bachmann1234/diff_cover#612] Thanks @​Sanjays2402

• Accept reports/options in diff_cover_report_quality hookspec- (PR 613)[https://redirect.github.com/fix(plugins): accept reports/options in diff_cover_report_quality hookspec Bachmann1234/diff_cover#613] Thanks @​Sanjays2402

7/23/2026 v10.4.1

• Handle low confidence chardet detection for undeclared encodings. Fixes a failing test for chardet 7 and upgrades the tested suite to chardet7 (PR 611)[https://redirect.github.com/Handle low confidence chardet detection for undeclared encodings Bachmann1234/diff_cover#611] (bachmann1234)

7/21/2026 v10.4.0

• Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

• Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

• Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

• Fix --help hiding most CLI options in diff-cover/diff-quality PR 599 Thanks @​duxiaocheng

01/08/2026 v10.2.0

• Fixes issue where diff quality could not be run from subfolders PR 574 Issue 573 Thanks @​eacherkan-via

12/30/2025 v10.1.0

• Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

• Remove python 3.9 support
• Add python 3.14 support
• Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

• Fix file path issue on windows. Thanks @​amos-chen PR 553

09/25/2025 v9.7.1

... (truncated)

Commits

• 8111a37 Version 10.4.1
• 291ee94 Handle low confidence chardet detection for undeclared encodings (#611)
• 147b410 Bump setuptools from 80.9.0 to 83.0.0 (#609)
• 8881685 Version 10.4.0
• ca4effc Add --branch-coverage flag to respect partial branch coverage (#608)
• b746a1b Bump pylint from 4.0.5 to 4.0.6 (#607)
• 85c493c Bump ruff from 0.15.15 to 0.15.20 (#606)
• c61cc9c Bump actions/checkout from 6 to 7 (#605)
• 4e02dae Bump actions/cache from 5 to 6 (#604)
• 42632b3 Bump black from 26.3.1 to 26.5.1 (#603)
• Additional commits viewable in compare view

Updates pip from 26.1.2 to 26.2

Changelog

Sourced from pip's changelog.

26.2 (2026-07-29)

Deprecations and Removals

• Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

• Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

  The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

• Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

• Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

• Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

• Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

• Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

• Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

• Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

• Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

• Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

  Note that the feature has limited compatibility with --use-feature=inprocess-build-deps. While most builds should work with both features enabled, there are known edge cases. inprocess-build-deps will not be enabled by default until they are fixed. ([#14070](https://github.com/pypa/pip/issues/14070) <https://github.com/pypa/pip/issues/14070>_)

• Present more informative diagnostic errors on uncaught network errors. ([#14115](https://github.com/pypa/pip/issues/14115) <https://github.com/pypa/pip/issues/14115>_)

• Allow opting out of Git partial clones with PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER. ([#11043](https://github.com/pypa/pip/issues/11043) <https://github.com/pypa/pip/issues/11043>_)

• Add a --no-proxy-env (or --proxy "") option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with --proxy is still used. ([#5378](https://github.com/pypa/pip/issues/5378) <https://github.com/pypa/pip/issues/5378>_)

• Add support for pulling username from keyring subprocess provider ([#12543](https://github.com/pypa/pip/issues/12543) <https://github.com/pypa/pip/issues/12543>_)

• Speedup tab autocompletion by lazy-importing certain modules. ([#4768](https://github.com/pypa/pip/issues/4768) <https://github.com/pypa/pip/issues/4768>_)

... (truncated)

Commits

• 4b6ae5c Bump for release
• 50b6d3c Update AUTHORS.txt
• dbddfbd Tweak news entries for pip 26.2 (#14212)
• 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
• 0090e00 Address a variety of typos detected in code review
• e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
• 5eefdbc Better conflict report for requirements from -r pylock.toml
• 6d71ff8 Test --only-final with -r pylock.toml
• e7d6eb9 Refactor -r pylock.toml
• 756506d Add TODO about pylock.select and --no-binary
• Additional commits viewable in compare view

Updates genai-prices from 0.1.0 to 0.1.1

Commits

• 3a6b749 Prep 0.1.1 release (#545)
• c436fe6 fix(js): normalize downloaded price constraints (#544)
• 78bce8c Collapse generated diffs, pin the frozen v1 snapshots, document price-history...
• 1ce2a45 Fix GPT-5.6 Luna and Terra price history (#535)
• d6fa536 fix: harden JavaScript provider data activation (#522)
• f596b71 Refresh agent-facing docs for the v2 data contract (#534)
• 810d9d3 Update OpenAI gpt-5.6 family prices (terra & luna reduced) (#531)
• 8af4529 Expand usages.json tests (#529)
• See full diff in compare view

Updates fastmcp from 3.4.2 to 3.4.5

Release notes

Sourced from fastmcp's releases.

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #4517 to release/3.x: skip unsupported JWKS keys (#4515) by @​kakiii in PrefectHQ/fastmcp#4631
• Backport #4469 to release/3.x: fix Azure scope fallback by @​jlowin in PrefectHQ/fastmcp#4662
• Backport #4523 to release/3.x: serialize deep object query parameters by @​jlowin in PrefectHQ/fastmcp#4664
• Backport #4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in PrefectHQ/fastmcp#4665
• Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in PrefectHQ/fastmcp#4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in PrefectHQ/fastmcp#4673

New Contributors

• @​kakiii made their first contribution in PrefectHQ/fastmcp#4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in PrefectHQ/fastmcp#4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in PrefectHQ/fastmcp#4439
• Restore HTTP host guard compatibility by @​jlowin in PrefectHQ/fastmcp#4472

Docs 📚

• Docs: add v3.4.4 changelog entries by @​jlowin in PrefectHQ/fastmcp#4473

New Contributors

• @​evalstate made their first contribution in PrefectHQ/fastmcp#4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

• Dedupe discriminator-required helper across schema converters by @​jlowin in PrefectHQ/fastmcp#4362
• Add real Monty sandbox e2e coverage for CodeMode call_tool by @​AlexlaGuardia in PrefectHQ/fastmcp#4274
• Switch prettier hook to rbubley/mirrors-prettier by @​jlowin in PrefectHQ/fastmcp#4366
• feat(remote): add --verify flag for TLS certificate verification by @​jlowin in PrefectHQ/fastmcp#4369

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.7: Know Your Audience

FastMCP 3.4.7 fixes CIMD private_key_jwt authentication on bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised in OAuth metadata.

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in #4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in #4810

Full Changelog: v3.4.6...v3.4.7

v3.4.6: Trust, but Proxy

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

Fixes 🐞

• Backport #4412 to 3.x: support trusted SSRF proxies by @​jlowin in #4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in #4761

Full Changelog: v3.4.5...v3.4.6

v4.0.0b1: Fourgone Conclusion

FastMCP 4 makes stateful MCP applications work on the sessionless 2026-07-28 protocol while one deployment continues serving handshake-era clients. Tools can ask follow-up questions across requests, preserve authenticated user state, and move long-running work into background tasks without sticky sessions. Protocol extensions and enterprise identity become first-class surfaces, and most FastMCP 3 servers upgrade unchanged even though MCP Python SDK v2 rewrote the engine underneath them. Server-initiated sampling and roots are removed from the server API; the upgrade guide covers their replacements.

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in #4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in #4450
• Forward-port Hugging Face auth provider by @​jlowin in #4475
• Add server-side identity assertion (SEP-990 ID-JAG) by @​jlowin in #4483

... (truncated)

Commits

• 8de0c94 Docs: add v3.4.5 changelog entries (#4673)
• 5daa91b Backport #4492 to release/3.x: don't mutate the caller's schema in compress_s...
• 49c5ed5 Make transformed tool required order deterministic (#4564) (#4665)
• 87ba18c Serialize deep object query parameters (#4523) (#4664)
• aa8ab1e Fix Azure scope fallback (#4469) (#4662)
• 93696a5 Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#451...
• 9138d40 Docs: add v3.4.4 changelog entries (#4473)
• d929882 Hugging Face Auth Integration (#4385)
• 5fe4fae Restore HTTP host guard compatibility (#4472)
• 400db61 Relax host origin guard defaults (#4439)
• Additional commits viewable in compare view

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

• No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

• Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
• Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
• Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
• Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
• Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
• 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
• 24c237d [mypyc] Improve documentation of Final (#21713)
• b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
• cbcb51a Narrow for frozendict membership check (#21709)
• af2bc0f Sync typeshed (#21707)
• Additional commits viewable in compare view

Updates ruff from 0.15.19 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (

[macroscopeapp]

Approvability

Verdict: Approved 17db822

Routine dependabot lock file update bumping 15 Python dependencies to newer minor/patch versions. Only uv.lock is modified - no source code or configuration changes.

^{You can customize Macroscope's approvability policy. Learn more.}