Repository navigation
chore(deps): uv: bump the all-python group across 1 directory with 10 updates - #859
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Not mergeable as grouped — one breaking major, plus a silent break of a documented cross-ecosystem lockstep. 1. The 2. and This PR changes only Worth noting the config already handles exactly this shape for the Cedar engines — The remaining bumps in this group (boto3, fastapi, uvicorn, pygments, aws-opentelemetry-distro, bedrock-agentcore) look routine. As in #860, they cannot be split out from here because Leaving open rather than closing: with the config unchanged, closing returns the same PR next Saturday. |
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost is already concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it has sat unmergeable for five days. #870 exists to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost is already concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it has sat unmergeable for five days. #870 exists to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost was concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it sat unmergeable for five days. #870 had to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
22c37e7 to
fe0e73b
Compare
scottschreckengaust
left a comment
scottschreckengaust
left a comment
There was a problem hiding this comment.
Verdict: Request changes
This Dependabot all-python group bump is not mergeable as grouped. Two of the ten updates are breaking: mcp 1.28.1 → 2.1.1 is a hard, empirically-confirmed break of the agent's Gateway bridge, and claude-agent-sdk 0.2.110 → 0.2.152 silently violates the documented #215 cross-ecosystem lockstep. CI already reflects this: build (agentcore) is FAILURE and the PR is BLOCKED. This confirms and re-states the earlier maintainer comment (@isadeks) against the current head fe0e73b (the group was rebased from 0.2.148 → 0.2.152 / mcp 2.1.1; the breakage is unchanged).
Vision alignment
Dependency hygiene supports the improvable / bounded tenet, and the routine bumps (boto3, botocore, fastapi, uvicorn, pygments, aws-opentelemetry-distro, bedrock-agentcore, ruff, ty) are welcome. But shipping a red agentcore build and a broken Gateway data path directly undercuts control-plane reliability — the bridge to abca_repo_config would fail closed-to-error at runtime, not degrade gracefully.
Blocking issues
1. mcp 1.28.1 → 2.1.1 (major) breaks agent/src/gateway_tools.py — agent/pyproject.toml:24.
I ran uv sync --frozen + uv run ty check src/gateway_tools.py at this head. Result: 6 diagnostics, all traceable to the mcp 2.x major:
error[unresolved-import]: Cannot resolve imported module "httpx"(gateway_tools.py:206, and the same unconditionalimport httpxat:85inside_sigv4_auth). mcp 2.x reshaped its transport deps: the lock removeshttpxentirely (replaced byhttpx2/httpcore2, uv.lock lines ~611-666).import httpxin_sigv4_authis not guarded by try/except, so the Gateway bridge raisesModuleNotFoundErrorat call time wheneverenableToolGateway=true. Confirmed:uv run python -c "import httpx"→ModuleNotFoundError.error[unresolved-import]: Module "mcp.shared.exceptions" has no member "McpError"(gateway_tools.py:212).error[invalid-argument-type]: Argument to bound method "ClientSession.call_tool" is incorrect(gateway_tools.py:178): 2.x now typesread_timeout_seconds: float | None, but the call passestimedelta(...).- (plus the
streamablehttp_client/mcp.client.streamable_httpand related fallout the maintainer noted.)
This is a real migration, not a lockfile refresh. Fix: either pin mcp below 2.0 in this group (add an ignore for mcp major in .github/dependabot.yml) or land a separate PR that migrates the gateway_tools.py call sites (httpx→httpx2 or whatever mcp 2.x re-exports, McpError new location, call_tool float timeout) with tests, then let the group bump ride on top.
2. claude-agent-sdk 0.2.110 → 0.2.152 breaks the #215 lockstep and lands a false comment — agent/pyproject.toml:19.
The pin at pyproject.toml:19 and agent/Dockerfile:76,90 are two halves of one documented invariant: the SDK bundles a claude CLI that must match the @anthropic-ai/claude-code@2.1.191 pin installed on PATH ("the SDK and the on-PATH CLI must agree on the control protocol", Dockerfile:77-78). This PR moves the SDK 42 patch releases but does not touch the Dockerfile, so the two diverge. Worse, the inline comment on line 19 still reads .../releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215) — a claim that is now false in the same commit. Dependabot can't see this because the halves live in different ecosystems (uv vs docker/npm). Durable fix: mirror the pattern already used for the Cedar engines (.github/dependabot.yml:48,71 reciprocal ignore for cedarpy ⊥ @cedar-policy/cedar-wasm) — add an ignore for claude-agent-sdk so it is bumped deliberately alongside the Dockerfile CLI pin and the comment. If the intent is to move the SDK, the Dockerfile CLI pin and the line-19 comment (URL tag + CLI version) must move in the same PR.
Non-blocking suggestions / nits
agent/pyproject.toml:19— even independent of blocker 2, the release-tag URL (v0.2.110) is stale relative to the==0.2.152pin. Update to the matching tag when the SDK moves.- Grouping friction (informational):
all-pythonusespatterns: ["*"]withopen-pull-requests-limit: 1, so the routine bumps genuinely cannot be split from the two breaking ones inside this PR. The reciprocal-ignorefixes above are what let the safe bumps flow next cycle without dragging the breaking ones along.
Documentation
No docs/guides or design changes required for a dep bump, and none shipped — appropriate. The one doc-like artifact that IS wrong is the in-repo invariant comment at pyproject.toml:19 (see blocker 2). No Starlight mirror impact.
Tests & CI
- CI:
build (agentcore)= FAILURE; PR mergeStateStatus = BLOCKED. CodeQL NEUTRAL, secrets/deps scan SUCCESS, PR-title checks SUCCESS. - I independently reproduced the agent typecheck failure (6
tydiagnostics) locally againstfe0e73b. - No bootstrap / CDK synth-coverage relevance: not applicable — this PR touches only
agent/pyproject.tomlandagent/uv.lock; no constructs, stacks, handlers, or CFN resource types change, so ADR-002 bootstrap-bundle checks do not apply. - Transitive-pin sync (#712): not applicable — no root
package.jsonresolutionschange, so theintegrations/jira-forge-appoverrides mirror is unaffected.
Review agents run
Execution context is a non-interactive subagent that cannot spawn the nested pr-review-toolkit agents or /security-review; I performed the equivalent analysis by hand and state that limitation explicitly here.
- code-reviewer (by hand): guideline check — dep-bump routing correct (agent tree), lockfile internally consistent; two breaking bumps flagged.
- silent-failure-hunter (by hand):
_sigv4_auth's unconditionalimport httpxis NOT in the try/except that_expected_gateway_errorsuses, so the Gateway path fails loudly withModuleNotFoundErrorrather than silently — but it fails, which is blocker 1. - type-design-analyzer (by hand): no new types;
call_tooltimeout contract changed under us (timedelta→float). - comment-analyzer (by hand):
pyproject.toml:19comment is now factually false (blocker 2 / nit). - pr-test-analyzer (by hand): no tests added; existing
agent/tests/test_gateway_tools.pywould need updates once the mcp 2.x call sites are migrated. - security-review (by hand): no IAM/Cedar/network/secrets/input-gateway surface changed; SigV4 signing logic untouched. No security findings beyond the availability break of the signed Gateway call.
Human heuristics
- Proportionality — Concern: a single grouped PR mixes 8 routine patch/minor bumps with 2 breaking changes; complexity of the fix (call-site migration + Dockerfile lockstep) far exceeds "refresh the lock".
- Coherence — Concern: the
claude-agent-sdk⊥ Dockerfile-CLI coupling is the same class as the already-guarded Cedar coupling (dependabot.yml:48,71) but lacks the reciprocal guard (agent/pyproject.toml:19). - Clarity — Concern:
pyproject.toml:19comment asserts a CLI/tag pairing that this commit invalidates. - Appropriateness — Concern: verified against real installed packages (uv sync + ty), not mocks; the break is real, not theoretical.
| "fastapi==0.141.1", #https://pypi.org/project/fastapi/ | ||
| "uvicorn==0.52.4", #https://pypi.org/project/uvicorn/ | ||
| "aws-opentelemetry-distro==0.19.0", #https://pypi.org/project/aws-opentelemetry-distro/ | ||
| "mcp==2.1.1", #https://pypi.org/project/mcp/ |
There was a problem hiding this comment.
Blocking: mcp 1.28.1 → 2.1.1 is a major bump that breaks agent/src/gateway_tools.py. Reproduced locally at this head with uv sync --frozen && uv run ty check src/gateway_tools.py — 6 diagnostics:
unresolved-import: Cannot resolve module "httpx"— mcp 2.x dropshttpxforhttpx2, so the lock no longer containshttpx; the unconditionalimport httpxin_sigv4_auth(gateway_tools.py:85) now raisesModuleNotFoundErrorat call time wheneverenableToolGateway=true.Module "mcp.shared.exceptions" has no member "McpError"(gateway_tools.py:212).ClientSession.call_tool(read_timeout_seconds=...)now wantsfloat | None, nottimedelta(gateway_tools.py:178).
This needs a real migration of the MCP client call sites, or pin mcp < 2.0 via a .github/dependabot.yml ignore. As-is, build (agentcore) is failing.
| "bedrock-agentcore==1.18.1", #https://pypi.org/project/bedrock-agentcore/ | ||
| "claude-agent-sdk==0.2.110", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215) | ||
| "bedrock-agentcore==1.22.0", #https://pypi.org/project/bedrock-agentcore/ | ||
| "claude-agent-sdk==0.2.152", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215) |
There was a problem hiding this comment.
Blocking: claude-agent-sdk 0.2.110 → 0.2.152 breaks the documented #215 lockstep. This comment still asserts v0.2.110 and bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile — but the Dockerfile pin (@anthropic-ai/claude-code@2.1.191, Dockerfile:90) is untouched here, so the SDK-bundled CLI and the on-PATH CLI now diverge, and the comment is false in this same commit.
Fix: either move the Dockerfile CLI pin + this comment (URL tag and CLI version) in the same PR, or add a reciprocal ignore for claude-agent-sdk in .github/dependabot.yml mirroring the Cedar-engine guard at lines 48/71, so it is bumped deliberately with the Dockerfile.
67715e7 to
3874a54
Compare
… updates Bumps the all-python group with 10 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.78` | `1.43.103` | | [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.18.1` | `1.23.1` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.160` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.141.1` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.54.0` | | [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.20.0` | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.2.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.9` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.84` | | [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` | Updates `boto3` from 1.43.78 to 1.43.103 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.78...1.43.103) Updates `bedrock-agentcore` from 1.18.1 to 1.23.1 - [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases) - [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md) - [Commits](aws/bedrock-agentcore-sdk-python@v1.18.1...v1.23.1) Updates `claude-agent-sdk` from 0.2.110 to 0.2.160 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.160) Updates `fastapi` from 0.139.0 to 0.141.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.141.1) Updates `uvicorn` from 0.50.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.54.0) Updates `aws-opentelemetry-distro` from 0.18.0 to 0.20.0 - [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases) - [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md) - [Commits](aws-observability/aws-otel-python-instrumentation@v0.18.0...v0.20.0) Updates `mcp` from 1.28.1 to 2.2.0 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.2.0) Updates `ruff` from 0.15.20 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.16.9) Updates `ty` from 0.0.56 to 0.0.84 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.84) Updates `pygments` from 2.20.0 to 2.21.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) --- updated-dependencies: - dependency-name: aws-opentelemetry-distro dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: bedrock-agentcore dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: boto3 dependency-version: 1.43.83 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.148 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: mcp dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-python - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ty dependency-version: 0.0.75 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.52.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
3874a54 to
6676787
Compare
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
Bumps the all-python group with 10 updates in the /agent directory:
1.43.781.43.1031.18.11.23.10.2.1100.2.1600.139.00.141.10.50.00.54.00.18.00.20.01.28.12.2.00.15.200.16.90.0.560.0.842.20.02.21.0Updates
boto3from 1.43.78 to 1.43.103Commits
0470368Merge branch 'release-1.43.103'1b65309Bumping version to 1.43.103655adc5Add changelog entries from botocoreda00dd2Merge branch 'release-1.43.102'76d6266Merge branch 'release-1.43.102' into develop551d660Bumping version to 1.43.102f63e52eAdd changelog entries from botocorea1acf79Merge branch 'release-1.43.101'931d5a2Merge branch 'release-1.43.101' into develop8c719efBumping version to 1.43.101Updates
bedrock-agentcorefrom 1.18.1 to 1.23.1Release notes
Sourced from bedrock-agentcore's releases.
... (truncated)
Changelog
Sourced from bedrock-agentcore's changelog.
... (truncated)
Commits
aea2005chore: bump version to 1.23.1 (#668)2715d6ffix(integ): adjust timeout on memory test. (#667)cc980d1fix(memory): use current Strands bidi session hooks (#664)9f31042chore: bump version to 1.23.0 (#662)3c9f15eBump agentcore-devx-devtools reusable workflow pin (#660)cf71b14feat(tools): add WebSearchClient for invoking Amazon Web Search (#658)7f75652feat(gateway): add create_web_search_target() helper (#656)826416afix(runtime): update shell session wire protocol (#642)d53af20feat: add RAGAS adapter for third-party eval metrics (#618)ddfab76ci: use dedicated release runners (#645)Updates
claude-agent-sdkfrom 0.2.110 to 0.2.160Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
... (truncated)
Commits
36f9548docs: update changelog for v0.2.160a076a6achore: release v0.2.1600615c04chore: bump bundled CLI version to 2.1.283dbc975efix: keep stdin open until the CLI reports idle so follow-up turns are served...6c3df98ci: skip wheels over PyPI's per-file limit instead of failing the release (#1...5889056docs: align docstrings with the code and fix docstring formatting (#1293)3aeceedchore: bump bundled CLI version to 2.1.2822b87034docs: update changelog for v0.2.1590606b85chore: release v0.2.159479a65bchore: bump bundled CLI version to 2.1.281Updates
fastapifrom 0.139.0 to 0.141.1Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
95f8322🔖 Release version 0.141.1 (#16106)f137944📝 Update release notesd623544🐛 Fix support for background tasks and headers from dependencies in `app.fron...1d211b9📝 Update release notes8a1f876📝 DocumentFASTAPI_ENVin FastAPI CLI guide (#16104)c7e7b65🔖 Release version 0.141.0 (#16103)6bceb84📝 Update release notes5429fed✨ Addapp.frontend(check_dir="auto"), to make local development more conven...628663f🔖 Release version 0.140.13 (#16096)0b54fd0📝 Update release notesUpdates
uvicornfrom 0.50.0 to 0.54.0Release notes
Sourced from uvicorn's releases.
... (truncated)
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
3eb9a9aVersion 0.54.0 (#3161)cd7ef6dRemove races from supervisor tests (#3134)a56c7ccSupport HTTP/2 response trailers (#3146)9bd4404chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)21f39efAdd HTTP/2 Early Hints support (#3137)421708fVersion 0.53.0 (#3136)f1a1bffUnset the keep-alive timer when upgrading to WebSocket (#3107)63971edDocument HTTP/2 support (#3130)7d1a005Remove race from multiprocess health check test (#3128)5ac6265Add ::1 to FORWARDED_ALLOW_IPS (#3119)Updates
aws-opentelemetry-distrofrom 0.18.0 to 0.20.0Release notes
Sourced from aws-opentelemetry-distro's releases.
... (truncated)
Changelog
Sourced from aws-opentelemetry-distro's changelog.
... (truncated)
Commits
64ea3b8Pre-release: Update version to 0.20.0 (#895)5bca20fRevert "Adding artifact verification post-build in the release workflow" (#891)09f483cfeat(genai): add AWS instrumentation controls (#893)fc7a858fix AttributePropagatingSpanProcessor with NonRecordingSpan as parent (#744)d600552fix: cap native instrumentation dependency majors (#884)9fdeed4fix(langchain): propagate first input, last output, and system instructions t...e9edfd1feat: redact span, span event, and span link attributes via ADOT_REDACT_SPAN_...87c759fAdding artifact verification post-build in the release workflow (#869)6bb82aaGh actions workflow optimization (#887)14801b0feat(langchain): classify LangGraph StateGraph invocations as agent or workfl...Updates
mcpfrom 1.28.1 to 2.2.0Release notes
Sourced from mcp's releases.
... (truncated)
Commits
9972c21Replace RootModel wrappers with type aliases and TypeAdapter validation (#3470)fd66270docs: refresh translations, and translate pages in parallel (#3458)08a3bc8docs: ask for AI disclosure on comments too (#3459)7bb486adocs: stop presenting the in-memory client as the way to connect (#3443)0c91368Add AuthSettings.validate_token_resource to check a bearer token's resource (...9771e6bKeep following a relative redirect when the endpoint URL carries userinfo (#3...a925e55Bump the locked versions of eight dev and test dependencies (#3449)e8b9486Bump pymdown-extensions from 11.0 to 11.0.1 (#3285)c6762e8Follow redirects only within the MCP endpoint's origin (#3397)5fd3abcSkip automatic docs previews for fork PRs and drop the setup-uv retry steps (...Updates
rufffrom 0.15.20 to 0.16.9Release notes
Sourced from