Skip to content

chore: Update Python dependencies#2015

Merged
Aureliolo merged 1 commit into
mainfrom
renovate/python
May 19, 2026
Merged

chore: Update Python dependencies#2015
Aureliolo merged 1 commit into
mainfrom
renovate/python

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 19, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
hypothesis (changelog) ==6.152.7 → ==6.152.9 age confidence
litellm ==1.84.0 → ==1.85.0 age confidence
lxml (source, changelog) ==6.1.0 → ==6.1.1 age confidence
types-pyyaml (changelog) ==6.0.12.20260510 → ==6.0.12.20260518 age confidence
zensical (changelog) ==0.0.42 → ==0.0.43 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

BerriAI/litellm (litellm)

v1.85.0

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.85.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.85.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.85.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Between 12:00 AM and 06:59 AM, only on Saturday (* 0-6 * * 6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from Aureliolo as a code owner May 19, 2026 18:50
@renovate renovate Bot added dependencies Pull requests that update a dependency file type:chore Maintenance, cleanup, dependency updates labels May 19, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 19, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 3 package(s) with unknown licenses.
See the Details below.

License Issues

uv.lock

PackageVersionLicenseIssue Type
lxml6.1.1NullUnknown License
types-pyyaml6.0.12.20260518NullUnknown License
zensical0.0.43NullUnknown License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, PSF-2.0, Unlicense, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Python-2.0, Python-2.0.1, LicenseRef-scancode-free-unknown, LicenseRef-scancode-protobuf, LicenseRef-scancode-google-patent-license-golang, ZPL-2.1, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, BlueOak-1.0.0, OFL-1.1
Excluded from license check: pkg:pypi/mem0ai@2.0.1, pkg:pypi/numpy@2.4.4, pkg:pypi/qdrant-client@1.17.1, pkg:pypi/posthog@7.9.12, pkg:pypi/aiohttp@3.13.5, pkg:pypi/cyclonedx-python-lib@11.7.0, pkg:pypi/fsspec@2026.3.0, pkg:pypi/griffelib@2.0.2, pkg:pypi/grpcio@1.80.0, pkg:pypi/charset-normalizer@3.4.6, pkg:pypi/wrapt@2.1.2, pkg:pypi/pytest-codspeed@4.5.0, pkg:pypi/hypothesis@6.152.4, pkg:pypi/litellm@1.83.14, pkg:pypi/openai@2.33.0, pkg:pypi/pyngrok@8.1.2, pkg:pypi/tokenizers@0.23.1, pkg:pypi/typer@0.25.0, pkg:npm/@img/sharp-wasm32@0.33.5, pkg:npm/@img/sharp-win32-ia32@0.33.5, pkg:npm/@img/sharp-win32-x64@0.33.5, pkg:npm/json-schema-typed@8.0.2, pkg:npm/victory-vendor@37.3.6, pkg:pypi/scikit-learn@1.8.0, pkg:pypi/torch@2.11.0, pkg:pypi/cuda-bindings@13.2.0, pkg:pypi/cuda-pathfinder@1.5.0, pkg:pypi/cuda-toolkit@13.0.2, pkg:pypi/nvidia-cublas@13.1.0.3, pkg:pypi/nvidia-cuda-cupti@13.0.85, pkg:pypi/nvidia-cuda-nvrtc@13.0.88, pkg:pypi/nvidia-cuda-runtime@13.0.96, pkg:pypi/nvidia-cudnn-cu13@9.19.0.56, pkg:pypi/nvidia-cufft@12.0.0.61, pkg:pypi/nvidia-cufile@1.15.1.6, pkg:pypi/nvidia-curand@10.4.0.35, pkg:pypi/nvidia-cusolver@12.0.4.66, pkg:pypi/nvidia-cusparse@12.6.3.3, pkg:pypi/nvidia-cusparselt-cu13@0.8.0, pkg:pypi/nvidia-nccl-cu13@2.28.9, pkg:pypi/nvidia-nvjitlink@13.0.88, pkg:pypi/nvidia-nvshmem-cu13@3.4.5, pkg:pypi/nvidia-nvtx@13.0.85

OpenSSF Scorecard

PackageVersionScoreDetails
pip/hypothesis 6.152.9 UnknownUnknown
pip/litellm 1.85.0 UnknownUnknown
pip/lxml 6.1.1 UnknownUnknown
pip/types-pyyaml 6.0.12.20260518 UnknownUnknown
pip/zensical 0.0.43 UnknownUnknown

Scanned Files

  • uv.lock

@renovate renovate Bot temporarily deployed to cloudflare-preview May 19, 2026 18:52 Inactive
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 19, 2026 •
edited
Loading

Merging this PR will not alter performance

✅ 33 untouched benchmarks
⏩ 21 skipped benchmarks1

Comparing renovate/python (dc15977) with main (29b64e3)

Open in CodSpeed

Footnotes

  1. 21 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@codecov
Copy link
Copy Markdown

codecov Bot commented May 19, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.09%. Comparing base (29b64e3) to head (dc15977).
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #2015      +/-   ##
==========================================
- Coverage   85.09%   85.09%   -0.01%     
==========================================
  Files        1913     1913              
  Lines      113388   113388              
  Branches     9673     9673              
==========================================
- Hits        96487    96483       -4     
- Misses      14532    14535       +3     
- Partials     2369     2370       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot force-pushed the renovate/python branch from 22bf9d0 to dc15977 Compare May 19, 2026 19:25
@renovate renovate Bot temporarily deployed to cloudflare-preview May 19, 2026 19:27 Inactive
Aureliolo
Aureliolo approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@Aureliolo Aureliolo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Decision: Patch/stub-only Python dependency bump (5 packages); CI fully green (unit/integration/e2e/conformance + Doc Drift Gate + Build/Deploy Preview all SUCCESS); no breaking changes affecting us; lands an lxml security patch.

Changelog digest:

  • Covered: hypothesis 6.152.7->6.152.9, litellm 1.84.0->1.85.0, lxml 6.1.0->6.1.1, types-pyyaml 6.0.12.20260510->6.0.12.20260518, zensical 0.0.42->0.0.43.
  • Relevant (security): lxml 6.1.1 adds the missing xlink:href to lxml.html.defs.link_attrs (URL-bypass in embedded SVG/MathML) and ships wheels with libxslt patched for CVE-2025-7424 + CVE-2025-11731; lxml backs HTMLParseGuard (SEC-1 prompt safety).
  • Relevant (behaviour, no action): litellm 1.85.0 adds streaming fallback on mid-stream httpx.TimeoutException, reasoning_effort handling fixes, and Anthropic tool-name sanitization; the library completion/acompletion API is unchanged and the proxy-side SSRF/auth hardening does not apply (we consume litellm as a library, not the proxy). hypothesis 6.152.9 smooths integer distribution (better bug-finding, not a regression); existing property tests pass on CI. zensical 0.0.43 is link-validation + BOM-strip bug fixes only; docs build verified by green Build Preview + Deploy Preview + Doc Drift Gate on the PR head (local rebuild strictly less evidence).
  • Reviewed but not relevant: hypothesis 6.152.8 drops Django 4.2 (we don't use Django); types-pyyaml is a type-stub date bump.

Follow-ups: none.

@Aureliolo Aureliolo merged commit a7224bb into main May 19, 2026
82 checks passed
@Aureliolo Aureliolo deleted the renovate/python branch May 19, 2026 20:10
@Aureliolo Aureliolo temporarily deployed to cloudflare-preview May 19, 2026 20:10 — with GitHub Actions Inactive
@synthorg-repo-bot synthorg-repo-bot Bot mentioned this pull request May 19, 2026
Merged
Aureliolo pushed a commit that referenced this pull request May 19, 2026
@synthorg-repo-bot @github-actions
chore(main): release 0.8.6 (#2002)
f60e9ed 
<!-- HIGHLIGHTS_START -->
## Highlights

> _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub
Models). Commit-based changelog below._

### What you'll notice
- Multi-agent coordination is now active immediately on startup for
smoother operation.
- Governance rules are fully enforced during use, ensuring compliance at
all times.
- Coordination metrics update live, giving real-time insights into
system activity.
- Review agents are now reliably processed, preventing silent drops in
tasks.
- Sandbox containers can be reused for agents and tasks, speeding up
execution and reducing overhead.

### What's new
- Agents support online runtime with a minimal safety framework to
improve stability.
- Recorded LLM interactions can be deterministically replayed at the
provider interface.
- Distributed path validation has been enhanced for more robust data
routing.
- A client-simulation runtime was added for end-to-end testing of the
IntakeEngine.
- A new work pipeline spine architecture has been introduced to
streamline task processing.

### Under the hood
- Infrastructure, Python, and web dependencies have all been updated to
latest versions.
- Updated apko lockfiles in the CI/CD pipeline improve build
consistency.

<!-- HIGHLIGHTS_END -->

:robot: I have created a release *beep* *boop*
---


##
[0.8.6](v0.8.5...v0.8.6)
(2026-05-19)


### Features

* agent runtime online + minimal safety spine (runtime root)
([#2003](#2003))
([e5eef1a](e5eef1a)),
closes [#1956](#1956)
* deterministic recorded-LLM cassette replay at the provider chokepoint
([#2010](#2010))
([cabf55d](cabf55d))
* distributed path validation + hardening
([#2011](#2011))
([a382e4a](a382e4a)),
closes [#1966](#1966)
* wire IntakeEngine via boot client-simulation runtime (e2e test
harness) ([#2006](#2006))
([6a9c0aa](6a9c0aa)),
closes [#1961](#1961)
* work pipeline spine
([#1960](#1960))
([#2013](#2013))
([29b64e3](29b64e3))


### Bug Fixes

* bring the multi-agent coordinator online at boot
([#2007](#2007))
([180b38a](180b38a)),
closes [#1958](#1958)
* full governance enforcement online
([#1957](#1957))
([#2005](#2005))
([4140fc5](4140fc5))
* harden anti-ghost-wiring gate and fix silently-dropped review agents
([#2000](#2000))
([89b57ce](89b57ce))
* make coordination metrics live
([#1959](#1959))
([#2012](#2012))
([c4775e2](c4775e2))
* sandbox lifecycle dispatch (per-agent / per-task container reuse)
([#2008](#2008))
([03d2587](03d2587)),
closes [#1965](#1965)


### Documentation

* add GitButler concept-only concurrency research
([#1978](#1978))
([#2009](#2009))
([9e4f5c1](9e4f5c1))
* honest-hybrid refresh of README, site, and design specs
([#2001](#2001))
([f485bea](f485bea))


### CI/CD

* update apko lockfiles
([#2004](#2004))
([e2b9eee](e2b9eee))


### Maintenance

* Update Infrastructure dependencies
([#2014](#2014))
([0b16bdf](0b16bdf))
* Update Python dependencies
([#2015](#2015))
([a7224bb](a7224bb))
* Update Web dependencies
([#2016](#2016))
([7a7fe76](7a7fe76))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aureliolo Aureliolo Aureliolo approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file type:chore Maintenance, cleanup, dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Aureliolo