Skip to content

chore(deps): bump the python group with 16 updates - #542

Merged
itsskofficial merged 1 commit into
mainfrom
dependabot/pip/python-ef9b148fbc
Nov 1, 2026
Merged

chore(deps): bump the python group with 16 updates#542
itsskofficial merged 1 commit into
mainfrom
dependabot/pip/python-ef9b148fbc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastapi, pydantic, pydantic-settings, litellm, typer, tzdata, tzlocal, json-repair, ddgs, pypdf, playwright, aioimaplib, numpy, pytest, pytest-asyncio and ruff to permit the latest version.
Updates fastapi to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.
Commits

Updates pydantic to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pydantic-settings to 2.16.2

Commits
  • 94150a0 Prepare release 2.16.2 (#1111)
  • 9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
  • 7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
  • 2d1f924 Fix explicit nested secrets directory precedence (#1093)
  • e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
  • e71a53e Decode nested dictionary values with complex union types (#1089)
  • 8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
  • c50c853 Detect nested Field discriminators in default partial updates (#1076)
  • 9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • Additional commits viewable in compare view

Updates litellm to 1.106.6

Release notes

Sourced from litellm's releases.

v1.106.6

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.6

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.6/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.6

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.106.5...v1.106.6

Commits
  • 61c6ab7 Merge pull request #48680 from BerriAI/litellm_backport_46712_stable_1_106_x
  • 3f6653c bump: version 1.106.6
  • a1391ac fix(proxy): limit gzip to dashboard analytics and offload compression (#46712)
  • 2569eb8 Merge pull request #48605 from BerriAI/litellm_backport_48599_stable_1_106_x
  • 5197c97 bump: version 1.106.5
  • fb0506d fix(proxy): merge only dict client metadata into pass-through logging
  • 6566067 fix(proxy): always strip client guardrail info and mirror failure attribution...
  • 116dd05 fix(proxy): keep allowlisted metadata in proxy-only failure logs
  • 97474e4 fix(proxy): drop caller metadata from proxy-only failure logs
  • dd8d12d fix(proxy): build proxy-only failure logs from an allowlist and ignore reques...
  • Additional commits viewable in compare view

Updates typer to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

... (truncated)

Commits

Updates tzdata to 2026.6

Release notes

Sourced from tzdata's releases.

2026.6: Release of upstream tzdata 2026f

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

Changelog

Sourced from tzdata's changelog.

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b

... (truncated)

Commits

Updates tzlocal to 5.4.5

Changelog

Sourced from tzlocal's changelog.

5.4.5 (2026-10-22)

  • Recognize timezone file names with multiple slashes in the TZ environment variable.
  • Use HTTPS in place of FTP to retrieve tzdata archive.

5.4.4 (2026-06-29)

  • Improved handling if you have a syntax error in /etc/clock.

5.4.3 (2026-06-17)

  • Moved the tests back, removed the ones that check for symlinks. See issue #146

5.4.2 (2026-06-16)

  • [Yanked for distribution issues]

5.4.1 (2026-06-16)

  • [Yanked for distribution issues]

5.4 (2026-06-15)

  • Open files with Zone names as ascii.

  • Moved tests under tzlocal/tests and include them in distributions.

  • Dropped support for Python 3.9 and added support for 3.14.

5.3.1 (2025-03-05)

  • Now only warns bout /etc/timezone if it is actually conflicting with other timezone configurations.

5.3 (2025-02-13)

  • Now supports Python 3.9 to 3.13, and no longer requires backports.zoneinfo.

... (truncated)

Commits
  • ab833e7 Preparing release 5.4.5
  • 148d36d Update mappings
  • f84b23e Use HTTPS in place of FTP to retrieve tzdata archive in update_windows_mappin...
  • b5349f6 Recognize nested time zone names in TZ file paths (#186)
  • 6ef2c29 Back to development: 5.4.5
  • See full diff in compare view

Updates json-repair to 0.64.2

Release notes

Sourced from json-repair's releases.

Release 0.64.2

Added

  • Fix #239, add support for more Pydantic v2 standard

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Commits
  • f13a96b Fix #239, support prefixItems as for pydantic v2
  • f66bdff Merge pull request #238 from mangiucugna/dependabot/github_actions/astral-sh/...
  • 40009fd Bump astral-sh/setup-uv from 10.2.0 to 10.3.0
  • ace9b23 Fix #237, support some more pydantic standard
  • d34b372 Remove Python version 3.10 and update matrix
  • 975ea5f Fix formatting in pyproject.toml dependencies
  • e2c22a0 Update optional dependencies in pyproject.toml
  • a0099aa Update Python version from beta to release candidate
  • 15de6a2 Fix #233, recover a missing opening { in some special cases when the shape of...
  • 43c1db3 Merge pull request #235 from mangiucugna/dependabot/uv/ty-0.0.84
  • Additional commits viewable in compare view

Updates ddgs to 9.16.1

Release notes

Sourced from ddgs's releases.

v9.16.1

What's Changed

Full Changelog: deedy5/ddgs@v9.16.0...v9.16.1

Commits
  • 8e74959 chore(release): bump version to 9.16.1
  • 92ab081 fix(engines): disable Google
  • 85eebed fix(engines): add one iteration to extract results from pending futures
  • 8f2a4fb fix(engines): update Startpage
  • See full diff in compare view

Updates pypdf to 6.21.4

Release notes

Sourced from pypdf's releases.

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Documentation (DOC)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.21.4, 2026-10-28

Security (SEC)

  • Limit the number of copied page attributes during flattening (#4290)
  • Detect EOF when reading standard xref table trailer (#4289)
  • Fix loop detection when cloning DictionaryObject (#4288)

Documentation (DOC)

  • Exclude performance issues from security reports (#4280)

Full Changelog

Version 6.21.3, 2026-10-27

Security (SEC)

  • Use the validated page count after decrypting a document (#4270)
  • Limit total number of cross-reference stream entries (#4269)
  • Avoid excessive error messages (#4265)

Performance Improvements (PI)

  • Read flat page label number trees once for all pages (#4251)
  • Collect the named destinations once when resolving links (#4249)
  • Avoid scanning all objects in get_outline_root (#4245)

Bug Fixes (BUG)

  • Resolve indirect widths in CID font /W arrays (#4267)

Documentation (DOC)

  • Block incremental writes of encrypted documents (#4246)

Developer Experience (DEV)

  • Update to PyPy 3.12 and pinned requirements (#4244)

Maintenance (MAINT)

  • Revert: Reject unsupported key lengths in the /Encrypt dictionary

Full Changelog

Version 6.21.2, 2026-10-21

Security (SEC)

  • Avoid repeated full file loads (#4240)
  • Limit size of standard xref table (#4239)

Bug Fixes (BUG)

  • Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • Keep 8-bit DeviceRGB image mode (#4230)
  • Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

... (truncated)

Commits
  • b2c3fa2 REL: 6.21.4
  • ea4ac66 SEC: Limit the number of copied page attributes during flattening (#4290)
  • 06593f9 SEC: Detect EOF when reading standard xref table trailer (#4289)
  • f176db1 SEC: Fix loop detection when cloning DictionaryObject (#4288)
  • c7d391c PI: Speed up transformation matrix handling for layout mode text extraction (...
  • b330dcd DEV: Bump actions/setup-python from 7.0.0 to 7.1.0 (#4278)
  • 8901534 DOC: Exclude performance issues from security reports (#4280)
  • 70eab9b PI: Speed up parse_bfchar (#4273)
  • 4ef744f ROB: Skip an embedded file specification that is not a dictionary (#4256)
  • 945216f ROB: Keep the text state when a text state operator has no operand in layout ...
  • Additional commits viewable in compare view

Updates playwright to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Highlights

microsoft/playwright-python#3283 - chore: roll Node.js to 24.22.1

The bundled Node.js 24.22.1 is a security release that distrusts the compromised eMudhra intermediate CAs. The driver uses Node's CA store for its own TLS connections, for example connect_over_cdp to a wss:// endpoint.

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155
Commits
  • bcb9deb cherry-pick(#3283): chore: roll Node.js to 24.22.1
  • 387a8a9 cherry-pick(#3252): devops: publish to PyPI from GitHub Actions with trusted ...
  • 71d2a17 chore: roll Playwright to v1.64.0 (#3251)
  • d566fc5 fix(fetch): JSON-stringify NaN and Infinity string data (#3249)
  • 2959d19 docs(skills): add a skill to prepare a release (#3250)
  • 5313ac2 fix(network): keep blank values in Request.post_data_json for form bodies (#3...
  • 9d8c50f chore(codegen): use alphabetical order in the generated API (#3242)
  • 478282f chore(codegen): generate the public TypedDicts from the docs (#3247)
  • b8b7155 fix: raise Error instead of assert for user input validation (#3245)
  • 1de5d37 fix(network): do not add missing headers when looking them up (#3246)
  • Additional commits viewable in compare view

Updates aioimaplib to 2.0.3

Changelog

Sourced from aioimaplib's changelog.

V2.0.3

  • fix: raise connection errors from wait_hello_from_server #141 #91

V2.0.2

  • fix: reject NUL, CR and LF in command arguments to prevent command injection #140
  • build: drop Python 3.9 support, it is not maintained anymore
  • build: test with Python 3.12 and 3.13

V2.0.1

  • chore: keep connection task reference for future use see
  • chore: fix invalid escape sequences using r-strings #116
  • chore: drop Python2 crumbs #117

V2.0.0

  • refactor: rename imapserver into imap_testing_server
  • refactor: move imapserver into main package
  • refactor: move test module outside from main package
  • feat: add a script to be able to run imap testing server from command line

V1.2.0

Cleanup and build upgrades release. Library has not been changed since previous version.

  • build: passing from master to main default branch
  • build: test with python secure releases 3.9, 3.10, 3.11
  • refactor: tests passing from asynctest to pytest-asyncio
  • build: from setuptools to poetry

V1.1.0

  • feat: Add a scrub option to send(), use that with LOGIN and AUTHENTICATE #94
  • doc : Imap fetch example #89
  • feat: Imap Oauth for Outlook #84
  • tests: Use assert instead of unittest assertions #88
  • build: Pytest, tox and GHA closes #81

V1.0.1

... (truncated)

Commits
  • f1b3a1e [release] 2.0.3 see CHANGES.rst
  • 1375904 fix: raise connection errors from wait_hello_from_server
  • 2ba8710 [release] 2.0.2 see CHANGES.rst
  • 0662ffe ci: fix build for 3.13 ?
  • 5a43a9a chore: upgrading python versions
  • e71afde chore: upgrade lock file and change pyproject structure
  • 17f475e fix: drop python 3.9 as it is not maintained anymore
  • 89ed162 doc: update CHANGES
  • 8dda7f5 test: patch get_running_loop in the control character tests
  • 00d7db1 fix: reject NUL, CR and LF in command arguments
  • Additional commits viewable in compare view

Updates numpy to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the dependency groups from pyproject.toml to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

  • Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versi...

Description has been truncated

@dependabot
chore(deps): bump the python group with 16 updates
e24ab6d 
Updates the requirements on [fastapi](https://github.com/fastapi/fastapi), [pydantic](https://github.com/pydantic/pydantic), [pydantic-settings](https://github.com/pydantic/pydantic-settings), [litellm](https://github.com/BerriAI/litellm), [typer](https://github.com/fastapi/typer), [tzdata](https://github.com/python/tzdata), [tzlocal](https://github.com/regebro/tzlocal), [json-repair](https://github.com/mangiucugna/json_repair), [ddgs](https://github.com/deedy5/ddgs), [pypdf](https://github.com/py-pdf/pypdf), [playwright](https://github.com/microsoft/playwright-python), [aioimaplib](https://github.com/iroco-co/aioimaplib), [numpy](https://github.com/numpy/numpy), [pytest](https://github.com/pytest-dev/pytest), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version.

Updates `fastapi` to 0.162.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.142.2...0.162.0)

Updates `pydantic` to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.1)

Updates `pydantic-settings` to 2.16.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.2)

Updates `litellm` to 1.106.6
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.104.0...v1.106.6)

Updates `typer` to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `tzdata` to 2026.6
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.5...2026.6)

Updates `tzlocal` to 5.4.5
- [Changelog](https://github.com/regebro/tzlocal/blob/master/CHANGES.txt)
- [Commits](regebro/tzlocal@5.4.4...5.4.5)

Updates `json-repair` to 0.64.2
- [Release notes](https://github.com/mangiucugna/json_repair/releases)
- [Commits](mangiucugna/json_repair@v0.63.5...v0.64.2)

Updates `ddgs` to 9.16.1
- [Release notes](https://github.com/deedy5/ddgs/releases)
- [Commits](deedy5/ddgs@v9.16.0...v9.16.1)

Updates `pypdf` to 6.21.4
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.19.0...6.21.4)

Updates `playwright` to 1.64.1
- [Release notes](https://github.com/microsoft/playwright-python/releases)
- [Commits](microsoft/playwright-python@v1.63.0...v1.64.1)

Updates `aioimaplib` to 2.0.3
- [Changelog](https://github.com/iroco-co/aioimaplib/blob/main/CHANGES.rst)
- [Commits](iroco-co/aioimaplib@2.0.1...2.0.3)

Updates `numpy` to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `pytest` to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `pytest-asyncio` to 1.4.1
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.4.0...v1.4.1)

Updates `ruff` to 0.17.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.3)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pydantic-settings
  dependency-version: 2.16.2
  dependency-type: direct:production
  dependency-group: python
- dependency-name: litellm
  dependency-version: 1.106.6
  dependency-type: direct:production
  dependency-group: python
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  dependency-group: python
- dependency-name: tzdata
  dependency-version: '2026.6'
  dependency-type: direct:production
  dependency-group: python
- dependency-name: tzlocal
  dependency-version: 5.4.5
  dependency-type: direct:production
  dependency-group: python
- dependency-name: json-repair
  dependency-version: 0.64.2
  dependency-type: direct:production
  dependency-group: python
- dependency-name: ddgs
  dependency-version: 9.16.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pypdf
  dependency-version: 6.21.4
  dependency-type: direct:production
  dependency-group: python
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: aioimaplib
  dependency-version: 2.0.3
  dependency-type: direct:production
  dependency-group: python
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:development
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  dependency-group: python
- dependency-name: pytest-asyncio
  dependency-version: 1.4.1
  dependency-type: direct:development
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:development
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 1, 2026
@coderabbitai

coderabbitai Bot commented Nov 1, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 64b74e94-ec79-45b5-8137-fdd7a63756c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@itsskofficial itsskofficial mentioned this pull request Nov 1, 2026
Open
@itsskofficial

itsskofficial commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Tested for real from a fresh venv with this PR's dependencies (uv pip install -e ".[dev,voice,whatsapp]", Windows, Python 3.12.9).

The 16 bumps: fastapi 0.162.0, pydantic 2.14.1, pydantic-settings 2.16.2, litellm 1.106.6, typer 0.27.3, tzdata 2026.6, tzlocal 5.4.5, json-repair 0.64.2, ddgs 9.16.1, pypdf 6.21.4, playwright 1.64.1, aioimaplib 2.0.3, numpy 2.5.4 (voice extra), and in dev: pytest 9.2.0, pytest-asyncio 1.4.1, ruff 0.17.3.

The fresh resolve also moved, compared with my older dev venv: starlette 1.6 -> 1.10, pydantic-core 2.50, sse-starlette 3.6, pyee 13 -> 14 (playwright), pillow 12.3 -> 13.0, multidict 7, av 19 and tokenizers 0.23.3. mcp (2.3.0), openai, httpx, keyring and sqlite-vec are not bumped here.

Changelog risks, checked against our code

  • fastapi 0.162: omitted bool form fields no longer default to False. We have no bool Form() params (only File, plus Literal forms in core.py and voice.py), so this doesn't affect us.
  • pydantic 2.14: drops Python 3.9 and makes small validation changes. Nothing we rely on.
  • playwright 1.64.1: new bundled Chromium 156. We launch the system Edge or Chrome by channel, so no browser download is needed. The bundled Chromium only matters when the browser is set to "chromium".
  • aioimaplib 2.0.2 rejects CR/LF/NUL in command args, and 2.0.3 raises connection errors from the hello wait. Both are fine for us.
  • litellm 1.106.x, pypdf, ddgs, typer and tz*: fixes only, plus security fixes in pypdf.

Checks

  • ruff check (0.17.3): clean. CI still pins uvx ruff@0.16.7.
  • Full suite (-n 8): 3126 passed, 3 skipped, 1 failed. The failure was tests/channels/test_telegram.py::test_voice_note_is_transcribed_and_answered (sendVoice missing under load). It passed 3 times out of 3 alone, so it's flaky, not caused by this PR, and is filed as Flaky: test_voice_note_is_transcribed_and_answered misses the sendVoice reply under load #546.
  • tests/browser with live browser launches: 137 passed (playwright 1.64.1 driving Edge).

Real engine from this venv (fresh throwaway home, random token, port 8797):

  • claude-code/sonnet: the turn called web_search (ddgs, results from duckduckgo), then streamed 27 text_deltas. done in 20 s.
  • ollama_chat/qwen3:8b, with the Ollama lock held for about 4 minutes:
    • The tool-call turn called web_search, then streamed (305 thinking and 58 text deltas). done in 42 s.
    • Memory save: memory_remember returned ADD id 1, "Maya's favorite tea is masala chai with extra ginger.", with the fast role on qwen.
    • Recall in a new chat: "What kind of tea do I like?" was answered from memory. GET /api/memories?q=chai returned it with a bge-m3 vector score (similarity 0.59).
    • Browser on a local page: browser_open http://127.0.0.1:18542/page.html ran headless Edge and the answer was "The secret word on the page is marigold-42".
  • sentient mcp, through a stdio client (mcp 2.3.0): initialize gave server sentient, protocol 2025-11-25. It listed 8 tools (ask_sentient, memory_add, memory_get, memory_search, notify_me, task_create, task_list, task_status). memory_search "tea" returned the saved memory, task_list worked, and ask_sentient answered through Claude Code.

Frozen engine (numpy, litellm and tokenizers changed): packaging/build_engine.py built in 178 s and printed selfcheck ok (5 modules, database version 17), then served /api/health. I then started the frozen sentient-engine.exe on a fresh home and ran a claude-code/sonnet chat turn with a web_search call. It streamed and finished, with no import errors in its log.

Not covered: the voice extras at runtime (Whisper or Kokoro), real IMAP push (aioimaplib) and pypdf on real attachments. Those were covered by unit tests only.

Verdict: good to merge.

itsskofficial
itsskofficial approved these changes Nov 1, 2026
View reviewed changes

@itsskofficial itsskofficial left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fresh-venv full suite, real engine on claude-code/sonnet and qwen3:8b (tools, streaming, memory save/recall, browser), sentient mcp handshake and a frozen-engine build plus chat all pass. One unrelated flaky test filed as #546.

@itsskofficial
itsskofficial added this pull request to the merge queue Nov 1, 2026
Merged via the queue into main with commit 5461de5 Nov 1, 2026
10 checks passed
@itsskofficial
itsskofficial deleted the dependabot/pip/python-ef9b148fbc branch November 1, 2026 07:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@itsskofficial itsskofficial itsskofficial approved these changes
@Kabeer2004 Kabeer2004 Awaiting requested review from Kabeer2004 Kabeer2004 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@itsskofficial