chore(deps): uv: bump the all-python group across 1 directory with 10 updates - #859
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): uv: bump the all-python group across 1 directory with 10 updates#859dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
a team and
backgroundagents
as code owners
September 5, 2026 06:14
dependabot
Bot
added
dependencies
Contributor
|
Not mergeable as grouped — one breaking major, plus a silent break of a documented cross-ecosystem lockstep. 1. The 2. and This PR changes only Worth noting the config already handles exactly this shape for the Cedar engines — The remaining bumps in this group (boto3, fastapi, uvicorn, pygments, aws-opentelemetry-distro, bedrock-agentcore) look routine. As in #860, they cannot be split out from here because Leaving open rather than closing: with the config unchanged, closing returns the same PR next Saturday. |
This was referenced Sep 9, 2026
isadeks
added a commit
that referenced
this pull request
Sep 10, 2026
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost is already concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it has sat unmergeable for five days. #870 exists to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
isadeks
added a commit
that referenced
this pull request
Sep 10, 2026
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost is already concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it has sat unmergeable for five days. #870 exists to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
isadeks
added a commit
that referenced
this pull request
Sep 10, 2026
Each ecosystem groups every update into one PR with a PR limit of 1, so a breaking major freezes that ecosystem outright: the group PR cannot merge and the limit stops a second PR being opened for the safe remainder. #860 has held 47 npm updates since 2026-09-05 behind typescript 6->7 and cdk-nag 2->3, and #859 has held 10 python updates behind mcp 1->2. The cost was concrete: #860 carries astro 7.1.3 -> 7.2.9, which fixes GHSA-26w7-cxv4-gfx2 (CVSS 9.8), and it sat unmergeable for five days. #870 had to hand-write that same bump plus six other advisory fixes, duplicating work dependabot had already done. Exclude majors from the grouped PR instead of routing them to a second group. A group restricted to minor/patch would leave majors *ungrouped*, and an ungrouped update gets its own PR — that would mean one PR per major dependency, strictly worse than today. Ignoring them keeps the steady state at one grouped PR per ecosystem, the same count as now but without the wedge. - Ignore `version-update:semver-major` for `*` in all four ecosystems. Groups are left exactly as they are on main. - Raise `open-pull-requests-limit` 1 -> 2: one grouped PR plus a slot of headroom, so a lone ungrouped or security PR cannot starve the group. - Ignore `python` minor on docker (#105). 3.13 -> 3.14 must land with agent/mise.toml, agent/.python_version, the ruff and ty targets in agent/pyproject.toml, the lockfile, and three prose sites naming the base tag. #827 moved only the Dockerfile. Digest and patch refreshes still flow. - Ignore `claude-agent-sdk`, mirroring cedarpy. It bundles the `claude` CLI, pinned separately by an `npm install -g` line in agent/Dockerfile that is in no package.json — so no ecosystem tracks it and only a human can move it. An automated SDK bump diverges bundled from installed CLI and stales the version in pyproject's own comment (#215). - State `semver-major` explicitly on each per-dependency ignore even though the blanket rule covers it. The blanket rule is a policy that may be revisited; each per-dependency block is an invariant. Relaxing the policy must not silently degrade one. Trade-off: a major that fixes an advisory no longer arrives as a PR. Detection is unaffected — `//:security:deps` fails the build on any advisory regardless of dependabot — but the upgrade is driven by hand. Majors become issues.
… updates Bumps the all-python group with 10 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.78` | `1.43.89` | | [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.18.1` | `1.22.0` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.152` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.141.1` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.52.4` | | [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.19.0` | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.1.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.6` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.78` | | [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` | Updates `boto3` from 1.43.78 to 1.43.89 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.78...1.43.89) Updates `bedrock-agentcore` from 1.18.1 to 1.22.0 - [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases) - [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md) - [Commits](aws/bedrock-agentcore-sdk-python@v1.18.1...v1.22.0) Updates `claude-agent-sdk` from 0.2.110 to 0.2.152 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.152) Updates `fastapi` from 0.139.0 to 0.141.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.141.1) Updates `uvicorn` from 0.50.0 to 0.52.4 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.52.4) Updates `aws-opentelemetry-distro` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases) - [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md) - [Commits](aws-observability/aws-otel-python-instrumentation@v0.18.0...v0.19.0) Updates `mcp` from 1.28.1 to 2.1.1 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.1.1) Updates `ruff` from 0.15.20 to 0.16.6 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.16.6) Updates `ty` from 0.0.56 to 0.0.78 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.78) Updates `pygments` from 2.20.0 to 2.21.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) --- updated-dependencies: - dependency-name: aws-opentelemetry-distro dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: bedrock-agentcore dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: boto3 dependency-version: 1.43.83 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.148 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: mcp dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-python - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ty dependency-version: 0.0.75 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.52.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/uv/agent/all-python-4666157a7c
branch
from
September 12, 2026 06:15
22c37e7 to
fe0e73b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-python group with 10 updates in the /agent directory:
1.43.781.43.891.18.11.22.00.2.1100.2.1520.139.00.141.10.50.00.52.40.18.00.19.01.28.12.1.10.15.200.16.60.0.560.0.782.20.02.21.0Updates
boto3from 1.43.78 to 1.43.89Commits
1895b95Merge branch 'release-1.43.89'b85c521Bumping version to 1.43.89f729083Add changelog entries from botocorebb429b1Merge branch 'release-1.43.88'257465bMerge branch 'release-1.43.88' into develope373d8dBumping version to 1.43.886ce83deAdd changelog entries from botocored5740c2Merge branch 'release-1.43.87'bd30961Merge branch 'release-1.43.87' into develop316b72cBumping version to 1.43.87Updates
bedrock-agentcorefrom 1.18.1 to 1.22.0Release notes
Sourced from bedrock-agentcore's releases.
... (truncated)
Changelog
Sourced from bedrock-agentcore's changelog.
Commits
b981f7echore: bump version to 1.22.0 (#644)66a68e3feat(payments): add MPP, x402 upto, and Quick Create support (#643)5d4ca0dchore: bump version to 1.21.0 (#623)439d788feat(memory): add AgentCoreMemoryStore Strands integration (#588)01d3800feat(runtime): propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound cal...9195576chore: bump version to 1.20.0 (#619)703ccfdfix(test): pin autoevals judge to the OpenAI API (#617)207adb7fix(a2a): bind the A2A contract port, ignore generic PORT (#615)9d8cc26fix(test): repair eval adapter integ fixture and wire LLM judge key (#614)528471efix: validate sample agent inputs (#612)Updates
claude-agent-sdkfrom 0.2.110 to 0.2.152Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
... (truncated)
Commits
a8b1e28docs: update changelog for v0.2.1520b41fb4chore: release v0.2.152ed1718fchore: bump bundled CLI version to 2.1.25916606a3docs: update changelog for v0.2.151dbe3998chore: release v0.2.151637906echore: bump bundled CLI version to 2.1.2581539d2adocs: update changelog for v0.2.15023ca647chore: release v0.2.150036a35achore: bump bundled CLI version to 2.1.2579597fc9docs: update changelog for v0.2.149Updates
fastapifrom 0.139.0 to 0.141.1Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
95f8322🔖 Release version 0.141.1 (#16106)f137944📝 Update release notesd623544🐛 Fix support for background tasks and headers from dependencies in `app.fron...1d211b9📝 Update release notes8a1f876📝 DocumentFASTAPI_ENVin FastAPI CLI guide (#16104)c7e7b65🔖 Release version 0.141.0 (#16103)6bceb84📝 Update release notes5429fed✨ Addapp.frontend(check_dir="auto"), to make local development more conven...628663f🔖 Release version 0.140.13 (#16096)0b54fd0📝 Update release notesUpdates
uvicornfrom 0.50.0 to 0.52.4Release notes
Sourced from uvicorn's releases.
... (truncated)
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
8988c23Stabilize macOS Python 3.13 signal shutdown tests (#3084)898ddcaUpdate PyPI publish action to version 1.14.2 (#3083)3869f8aRestore Mermaid diagram rendering (#3080)64148a9Version 0.52.4 (#3079)9e9e569docs: correct release example PR number (#3072)b783dacRemove duplicate Date header from SansIO WebSocket handshakes (#3078)27019b2chore(deps): bump the python-packages group across 1 directory with 11 update...1b64273Fix a typo in index.md (#3006)a68da60Version 0.52.3 (#3068)6e3bb4cUse zttp 0.0.24 fast receive path (#3067)Updates
aws-opentelemetry-distrofrom 0.18.0 to 0.19.0Release notes
Sourced from aws-opentelemetry-distro's releases.
... (truncated)
Changelog
Sourced from aws-opentelemetry-distro's changelog.
Commits
821465aPre-release: Update version to 0.19.0 (#834)ed8782fBackport #797 to release/v0.19.x: add Python 3.14 Lambda runtime (#835)4dcbf60test(e2e): wire Python Lambda Lite SDK test into Application Signals E2E (#833)315bdddfix(mcp): extract server-side trace context from HTTP headers when _meta is a...76f8f2dNightly dependency update: OpenTelemetry 1.44.0/0.65b0 (#799)ffa8c72fix(mcp-instrumentation): inject W3C trace context into outbound HTTP headers...d7e49b5Revert "feat(genai): extract gen_ai.tool.call.arguments/result as LLO content...f9bb4f5feat(genai): capture user input and agent output on llama_index invoke_agent ...2b43f03Add best-effort public ECR image signing to release workflow (#828)9356e72Key incident-snapshot dedup hash on operation + throw-site origin (#825)Updates
mcpfrom 1.28.1 to 2.1.1Release notes
Sourced from mcp's releases.
... (truncated)
Commits
0921d94Point imports of mcp.server.fastmcp at the migration guide (#3388)4d6f87eBuild releases with the pinned hatchling and a publish action that accepts Me...c5d7d0bdocs: refresh translations for recent English changes (#3379)d8b6383Give recursive tool return types an object-rooted output schema (#3376)56af447Log MCPServer handler exceptions by kind and keep crash details off the wire ...f1c40b0Accept boolean sub-schemas in 2025-11-25 tool schema properties (#3354)57394b0Apply the request body limit to the SSE and OAuth endpoints (#3336)0cee624Hand TypedDict tool results to pydantic natively (#3331)0d92192Shorten stdio test comments (#3329)b2025abAcknowledge notification POSTs with 202 on the 2026-07-28 HTTP entry (#3326)Updates
rufffrom 0.15.20 to 0.16.6Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.