Skip to content

chore(deps): bump the python-runtime group across 1 directory with 7 updates - #305

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-2084738d3c
Closed

chore(deps): bump the python-runtime group across 1 directory with 7 updates#305
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-2084738d3c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, aiohttp, ta-lib, filelock, litellm, confluent-kafka and redis to permit the latest version.
Updates ruff to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates aiohttp to 3.14.5
Updates ta-lib from 0.8.1 to 0.8.2

Release notes

Sourced from ta-lib's releases.

v0.8.2

  • [NEW]: Support free-threaded CPython without enabling the GIL on import.

  • [NEW]: Include Python 3.15 wheels.

Changelog

Sourced from ta-lib's changelog.

0.8.2

  • [NEW]: Support free-threaded CPython without enabling the GIL on import.
Commits
  • 1543b71 .github: ignore 3.9 and 3.10 for now
  • cb94803 .github: not sure why v4 doesn't resolve
  • 403d443 .github/workflows: update
  • 4f7bf2e Bump version to 0.8.2 and document threading support
  • ce84452 Support free-threaded Python and release the GIL around native work
  • See full diff in compare view

Updates filelock to 4.2.4

Release notes

Sourced from filelock's releases.

4.2.4

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. #863

PyPI release

Full Changelog: tox-dev/filelock@4.2.3...4.2.4

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.2.4 (2026-10-19)

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

4.2.3 (2026-10-19)

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

4.2.2 (2026-10-18)

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

4.2.1 (2026-10-17)

  • On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
  • :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
  • Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

Updates litellm to 1.106.2

Release notes

Sourced from litellm's releases.

v1.106.2

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.106.1...v1.106.2

Commits
  • 49943cd Merge pull request #47695 from BerriAI/litellm_backport_lit145_batch_stable_1...
  • 43ae32c Merge branch 'stable/1.106.x' into litellm_backport_lit145_batch_stable_1_106_x
  • 500e19d Merge pull request #47736 from BerriAI/litellm_backport_p0_batch_translation_...
  • 4a6deef Merge branch 'stable/1.106.x' into litellm_backport_p0_batch_translation_cost...
  • 25c3121 Merge pull request #47742 from BerriAI/litellm_backport_46430_stable_1_106_x
  • 0aefd1b fix(anthropic): carry main's dangerous-tool-use beta map entries; skip worker...
  • 65c4fcd fix(count_tokens): fall back to Mantle on Bedrock 404 (Bedrock part of #46430)
  • dae6a2d bump: version 1.106.2
  • f44d4a7 chore(cost-map): accept the mirrored map's search_free_requests and token_cou...
  • ebf92c9 test: retarget tests that pinned prices the mirrored cost map now carries
  • Additional commits viewable in compare view

Updates confluent-kafka to 2.16.0

Release notes

Sourced from confluent-kafka's releases.

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

  • confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
  • Add Python 3.14t wheels (#2352)
  • Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
  • Producer close() now aborts any open transaction (#2347)
  • Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
  • SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
  • Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
  • New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
  • New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
  • New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
  • Add support for saving Azure key version with DEK (#2306)
  • Pass context when clients make KEK calls to DEK Registry (#2308)
  • Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
  • Add support for inline validation rules (#2326)
  • Add Variant, Decimal, and Timestamp CEL functions (#2332)

Fixes

... (truncated)

Changelog

Sourced from confluent-kafka's changelog.

v2.16.0

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

  • confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
  • Add Python 3.14t wheels (#2352)
  • Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
  • Producer close() now aborts any open transaction (#2347)
  • Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
  • Add support for CPython free-threading (PEP 703) to enable true multi-core parallel execution in No-GIL environments (#2347)
  • SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
  • Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
  • New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
  • New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
  • New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
  • Add support for saving Azure key version with DEK (#2306)
  • Pass context when clients make KEK calls to DEK Registry (#2308)
  • Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
  • Add support for inline validation rules (#2326)
  • Add Variant, Decimal, and Timestamp CEL functions (#2332)

... (truncated)

Commits
  • 4a1bcb0 Copy pyproject.toml into smoketest temp dir so asyncio_mode=auto applies (#2384)
  • 16ba967 Fix Unicode errors in string serialization (#2379)
  • 73a71f8 2.16.0 (#2380)
  • 20614ae Integrate Schema Registry serdes into the Kafka clients: serde builders, clus...
  • 7f2e72f Add s390x wheels to the build and verification matrix (#2360)
  • 6a54a83 chore: normalize service.yml field names (#2193)
  • c57c5b8 Fix Producer.purge() ignoring boolean flags on big-endian platforms (#2345)
  • 89c99e0 On Windows, the tag isn't currently given when building librdkafka, that affe...
  • cc1c970 v2.16.0rc2 (#2369)
  • d245efd Fix crash on nullable array of $ref items in JSON Schema CSFLE (#2370)
  • Additional commits viewable in compare view

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

  • Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
  • Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
  • Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
  • Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
  • Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
  • Sentinel — replica sentinel aliases (#4127).

🚀 New Features

  • Add replica sentinel aliases (#4127)
  • Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
  • feat: add TS.READ command support to the timeseries module (#4170)
  • feat: add SDIFFCARD and SUNIONCARD command support (#4171)
  • feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
  • feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
  • feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
  • feat: add COLLECT reducer support to search aggregations (#4179)
  • feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
  • feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
  • feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

  • feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

  • fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
  • Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits
  • e013126 Testing with 8.10 GA (#4227)
  • 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
  • d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
  • fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
  • 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
  • 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
  • 227280a Update lib version to 8.1.0
  • 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
  • 599fd75 feat: add FT.ALIASLIST support (#4198)
  • 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 24, 2026
@dependabot
chore(deps): bump the python-runtime group across 1 directory with 7 …
33d95b8 
…updates

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: confluent-kafka
  dependency-version: 2.16.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: filelock
  dependency-version: 4.2.4
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.106.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: ta-lib
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/backend_api_python/python-runtime-2084738d3c branch from 388ed2f to 33d95b8 Compare October 24, 2026 15:54
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 24, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/backend_api_python/python-runtime-2084738d3c branch October 24, 2026 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants