Skip to content

Bump the python-minor-and-patch group with 4 updates - #55

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-48ca8e0be0
Jul 27, 2026
Merged

Bump the python-minor-and-patch group with 4 updates#55
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-48ca8e0be0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 4 updates: litellm, google-adk, fastapi and ruff.

Updates litellm from 1.92.0 to 1.93.0

Release notes

Sourced from litellm's releases.

v1.93.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.93.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 052b5a2 Merge pull request #33904 from BerriAI/litellm_models_listing_malformed_cost_...
  • db190ba fix(proxy): treat malformed cost-map token limits as absent on /v1/models
  • 3510494 chore(release): backport #33853 and #33864 onto patch-1.93.0rc2 to complete t...
  • 2530e32 chore(release): backport 11 staging PRs onto patch-1.93.0rc2 for the 1.93.0 s...
  • b5cd431 Merge pull request #33499 from BerriAI/litellm_backport_1930rc2
  • fba058b Merge pull request #32956 from BerriAI/litellm_fix_lit3859_wif_bridge
  • 10d5804 Merge pull request #32884 from BerriAI/litellm_internal_staging
  • d37ba79 refactor(ui): convert projects page chart to shadcn/recharts (#32722)
  • 4baeb28 chore: update Next.js build artifacts (2026-07-11 23:35 UTC, node v20.20.2) (...
  • ca877c7 refactor(ui): colocate the usage view, keeping the shared usage components (#...
  • Additional commits viewable in compare view

Updates google-adk from 2.4.0 to 2.5.0

Release notes

Sourced from google-adk's releases.

v2.5.0

2.5.0 (2026-07-16)

Features

  • add Cloud Run sandbox option in code executors (5b1088a)
  • Add search agents and search MCP severs to agent registry (ed579c1)
  • add skill to verify markdown code snippets (c0fa51b)
  • Add strict input schema validation for LlmAgent workflow nodes (6f66814)
  • add to_mcp_server to serve an ADK agent over MCP (50ff37f)
  • agents: add single_turn mode field to ManagedAgent (da50578)
  • agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
  • agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
  • agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
  • bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
  • enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
  • live: allow Voice activity detection (VAD) events to be returned (820a910)
  • live: Run non-blocking tools in a background task (5620d8f)
  • plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
  • Support HITL resumption for standalone nodes and NodeTool (00760f8)
  • Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
  • Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
  • Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
  • workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

  • Add mTLS support for for API registry (41693dc)
  • Add mtls support for gcp_utils (3fa993b)
  • Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
  • avoid crash on first turn with empty user content (c9bacd4)
  • Avoid shell execution in ReadFileTool ranged reads (1ac6875)
  • block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
  • cli: Block special internal agents in ApiServer mode (3f6eb1f)
  • confine docs-agent file tools to the managed repos directory (f00fc5a)
  • decode shell skill output as UTF-8 (b7ad76a)
  • environment: add integer validation in ReadFileTool (3c0fb65)
  • exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
  • exclude rewound invocations from event compaction (0d4d378)
  • explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
  • Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
  • Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
  • GitHub CI for the verify-snippets skill (ccc8ab4)
  • grow eligible Gemini cache prefixes (98fc036)
  • guard decode_model against non-dict session values (8c60d99), closes #6348
  • handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
  • honor server-reported Gemini cache expiry (4fdc94c)
  • litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.5.0 (2026-07-16)

Features

  • add Cloud Run sandbox option in code executors (5b1088a)
  • Add search agents and search MCP severs to agent registry (ed579c1)
  • add skill to verify markdown code snippets (c0fa51b)
  • Add strict input schema validation for LlmAgent workflow nodes (6f66814)
  • add to_mcp_server to serve an ADK agent over MCP (50ff37f)
  • agents: add single_turn mode field to ManagedAgent (da50578)
  • agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)
  • agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)
  • agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)
  • bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)
  • enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)
  • live: allow Voice activity detection (VAD) events to be returned (820a910)
  • live: Run non-blocking tools in a background task (5620d8f)
  • plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)
  • Support HITL resumption for standalone nodes and NodeTool (00760f8)
  • Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)
  • Validate that no old orchestrators are used inside Workflow graphs (7e245c4)
  • Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)
  • workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

  • Add mTLS support for for API registry (41693dc)
  • Add mtls support for gcp_utils (3fa993b)
  • Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)
  • avoid crash on first turn with empty user content (c9bacd4)
  • Avoid shell execution in ReadFileTool ranged reads (1ac6875)
  • block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)
  • cli: Block special internal agents in ApiServer mode (3f6eb1f)
  • confine docs-agent file tools to the managed repos directory (f00fc5a)
  • decode shell skill output as UTF-8 (b7ad76a)
  • environment: add integer validation in ReadFileTool (3c0fb65)
  • exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164
  • exclude rewound invocations from event compaction (0d4d378)
  • explicitly preserve language and tools during event compaction (b44d2c9), closes #6273
  • Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)
  • Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)
  • GitHub CI for the verify-snippets skill (ccc8ab4)
  • grow eligible Gemini cache prefixes (98fc036)
  • guard decode_model against non-dict session values (8c60d99), closes #6348
  • handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352
  • honor server-reported Gemini cache expiry (4fdc94c)
  • litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)
  • litellm: preserve signature-only blocks for Anthropic streaming thinking aggregation (78d1957)

... (truncated)

Commits
  • 1e93d82 chore: update last-release-sha for next main release
  • 5e3b6f1 chore(release/candidate): release 2.5.0 (#6411)
  • c9bacd4 fix: avoid crash on first turn with empty user content
  • c03f333 fix: Prevent continuation forgery in tool confirmation
  • 2da09e6 fix: handle sqlite float timestamps in PreciseTimestamp
  • 065234e fix: preserve non-image file MIME type in LiteLlm content conversion
  • ecbefd9 fix: exclude LiteLlm llm_client from JSON serialization
  • 98fc036 fix: grow eligible Gemini cache prefixes
  • 221bad9 fix: require starlette>=1.3.1 to clear known CVEs
  • 8eb8348 test: re-enable finish_reason unknown-maps-to-other litellm test
  • Additional commits viewable in compare view

Updates fastapi from 0.139.0 to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

0.139.1

Fixes

  • 🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @​tiangolo.

Docs

  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @​YuriiMotov.

Translations

Internal

Commits
  • 866b7a3 🔖 Release version 0.139.2 (#16014)
  • 7b3effe 📝 Update release notes
  • 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
  • c48e67b 🔖 Release version 0.139.1 (#16012)
  • 2acc4fb 📝 Update release notes
  • eb75fd0 🐛 Fix frontend fallback support for doted paths like /users/john.doe (#16011)
  • 9b8410b 📝 Update release notes
  • e24d44c 📝 Fix topic repository list not being displayed and skip_users not being ap...
  • 93b78f8 📝 Update release notes
  • b959b44 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-minor-and-patch group with 4 updates: [litellm](https://github.com/BerriAI/litellm), [google-adk](https://github.com/google/adk-python), [fastapi](https://github.com/fastapi/fastapi) and [ruff](https://github.com/astral-sh/ruff).


Updates `litellm` from 1.92.0 to 1.93.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.92.0...v1.93.0)

Updates `google-adk` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/google/adk-python/releases)
- [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md)
- [Commits](google/adk-python@v2.4.0...v2.5.0)

Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.139.2)

Updates `ruff` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.15.22/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.15.22)

---
updated-dependencies:
- dependency-name: litellm
  dependency-version: 1.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-adk
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 27, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) July 27, 2026 02:58
@github-actions
github-actions Bot merged commit 561a6de into main Jul 27, 2026
6 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-48ca8e0be0 branch July 27, 2026 02:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants