Skip to content

MAINT: Bump the minor-and-patch group across 1 directory with 12 updates - #4200

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/minor-and-patch-b1f878b7f8
Open

MAINT: Bump the minor-and-patch group across 1 directory with 12 updates#4200
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/minor-and-patch-b1f878b7f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates in the / directory:

Package From To
aiohttp 3.14.4 3.14.5
fastapi 0.162.0 0.162.2
pydantic 2.14.2 2.14.3
pyodbc 5.3.0 5.5.0
python-multipart 0.0.32 0.0.33
regex 2026.9.29 2026.11.7
transformers 5.22.1 5.22.2
filelock 4.2.1 4.2.9
github-copilot-sdk 1.0.22 1.0.29
ty 0.0.97 0.0.99
sse-starlette 3.6.0 3.7.0
ruff 0.17.3 0.17.4

Updates aiohttp from 3.14.4 to 3.14.5
Updates fastapi from 0.162.0 to 0.162.2

Release notes

Sourced from fastapi's releases.

0.162.2

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Docs

Internal

0.162.1

Docs

Translations

Internal

Commits

Updates pydantic from 2.14.2 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

  • Build wheels for GraalPy 3.13 by @​msimacek in #14136.

    The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

Fixes

  • Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
  • Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
  • Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
  • Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
  • Disallow non string extra keys during validation by @​Viicos in #14135
  • Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • ea492e0 Bump pydantic-core to v2.50.4
  • 4f4a33f Prepare release v2.14.3
  • dca067b Benchmark TypedDict schema generation across builds
  • a2d1f6c Skip annotation handler setup when annotations are empty
  • 3ae0a40 Construct builtin scalar union schemas directly
  • 358d36f Skip general schema dispatch for builtin scalars
  • 3cc701a Improve schema generation for fixed type handlers
  • 762db7e Remove redundant None check in union schema generation
  • c214986 Bump pytest-codspeed to v5.0.4
  • 038ee97 Bump typing-inspection to v0.4.5
  • Additional commits viewable in compare view

Updates pyodbc from 5.3.0 to 5.5.0

Release notes

Sourced from pyodbc's releases.

5.5.0: DECIMAL fixes for PostgreSQL, and crash and memory-safety fixes

Version 5.5.0 has been released with wheels for Python 3.11 - 3.15

This release follows 5.4.0 closely. It fixes DECIMAL and NUMERIC values that 5.4.0 and earlier versions read or wrote incorrectly, mostly with PostgreSQL. It also fixes crashes and memory-safety bugs found in a review of the C++ code prompted by #1515. Most of the memory-safety bugs need an unusual setting, value, or driver to reach, but we recommend that everyone upgrade. It is 5.5.0 rather than 5.4.1 because it adds Connection.decimal_mode; there will be no 5.4.1.

Check your data

  • Writing a Decimal NaN or Infinity stored 0. In 5.4.0 and earlier, Cursor.execute() with a Decimal('NaN'), Decimal('sNaN'), Decimal('Infinity'), or Decimal('-Infinity') parameter raised SystemError, but only after the statement had run with the value 0. If such a value could have reached an insert or update that was then committed (with autocommit on, for example), the table may hold zeros where NaN or Infinity was intended.
  • PostgreSQL: some values read wrongly in 5.4.0. NaN, Infinity, and -Infinity were read as Decimal('0'), and values with more than 38 digits or more than 38 decimal places were read as a different number. The values in the database are correct, but values read with 5.4.0 and then stored or used elsewhere may not be. (5.3.0 raised an exception for NaN and Infinity, and read long values correctly.)

Upgrading from 5.4.0

  • If you followed the 5.4.0 notes and set Connection.fetch_decimal_as_string = True, it still works, but it now raises a FutureWarning, and it will be removed in 6.0. Use Connection.decimal_mode instead:

    • PostgreSQL: remove the line. The new default reads every value correctly. True selects the old text path, which cannot read NaN or Infinity, and False selects 'binary', which reads them as 0.
    • Other databases: decimal_mode = 'locale' behaves exactly like fetch_decimal_as_string = True. If your driver never adds thousands separators, decimal_mode = 'text' is stricter and is not affected by the locale.

  • Reading fetch_decimal_as_string also raises FutureWarning. To silence it until you update your code:

    warnings.filterwarnings("ignore", message=".*fetch_decimal_as_string", category=FutureWarning)

New features

  • Connection.decimal_mode selects how DECIMAL and NUMERIC values are read:
    • 'binary': into a SQL_NUMERIC_STRUCT, which is not affected by the locale. This is the 5.4.0 behavior and the default except for PostgreSQL. (With PostgreSQL it reads NaN and Infinity as 0.)
    • 'text': as text from drivers that never add thousands separators. The decimal point can be . or ,, whatever the locale, and NaN, Infinity, and -Infinity are read. Anything else raises DataError rather than being guessed at. This is the default for

... (truncated)

Commits
  • ced039c Build the macOS ARM64 wheels on macos-15
  • 8c8739c Update version to 5.5.0
  • 76c8566 nextset: raise on a closed cursor and when SQLNumResultCols fails; free the r...
  • 6599913 RaiseErrorV: clear any pending exception before creating the new one
  • 4bf133c Remove comments about Python 2
  • f391721 Use defaults when module settings are deleted
  • ed1efaf params: snapshot bytearray parameters, validate Decimal parts, and fix length...
  • 5bc7288 Bound the diagnostic record buffers and lengths
  • 980655d decimal: fix a dangling separator reference and escape the separator in the r...
  • 5d7e348 Terminate and bound the names passed to catalog functions
  • Additional commits viewable in compare view

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33
  • Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
  • Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
  • UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
  • Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
  • parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

  • Faster opening boundary matching (#328). Complete boundaries are matched in one step.
  • Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
  • Faster querystring callback dispatch (#316).

🐍 Python support

  • Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
  • Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

  • Drop Python 3.10 support #329.
  • Add Python 3.15 support #350.
  • Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
  • Normalize the content type returned by parse_options_header when the header has parameters #287.
  • Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
  • Keep only the incomplete escape when quoted-printable data is split across writes #355.
  • Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
  • Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
  • Speed up parser state lookups #330.
  • Speed up opening boundary matching #328.
  • Speed up querystring callback dispatch #316.
Commits
  • 9217f26 Bump version to 0.0.33 (#357)
  • d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
  • 44871df Handle nameless uploads when keeping the filename or extension (#343)
  • b21ea59 Add streaming field limits to FormParser (#333)
  • 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
  • 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
  • 95f6376 Use the shared security policy (#353)
  • 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
  • d7af81c Rewrite README for newcomers (#351)
  • b035d14 Add Python 3.15 classifier (#350)
  • Additional commits viewable in compare view

Updates regex from 2026.9.29 to 2026.11.7

Commits
  • bb0db39 Updated main.yml to build manylinux2014 wheels on Python 3.11.
  • ce4f246 Git issue 626: \X does not apply Unicode 18.0.0's changed GB9c (10 GraphemeBr...
  • edf9c06 Git issue 625: KeyError instead of ValueError when both VERSION0 and VERSION1...
  • See full diff in compare view

Updates transformers from 5.22.1 to 5.22.2

Release notes

Sourced from transformers's releases.

Patch release v5.22.2

Some in between patch for security and distributed fixes. See the included commits 🤗

Full Changelog: huggingface/transformers@v5.22.1...v5.22.2

Commits

Updates filelock from 4.2.1 to 4.2.9

Release notes

Sourced from filelock's releases.

4.2.9

Bug fixes

  • ReadWriteLock, SoftReadWriteLock and their async wrappers now raise TypeError for a blocking that is not a bool, in the constructor and on acquire, as FileLock already does. Before, blocking=0 waited out the full timeout on a contended ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (#908) by @​abhishekcpp007 and @​gaborbernat.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.2.8

Documentation

  • Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @​boyfeiyu.

New Contributors

🐍 PyPI release

📜 Full Changelog

4.2.7

Bug fixes

  • A SoftFileLease reclaims a dead holder's lease marker even when that holder published another lease_duration. It used to raise LeaseSettingsMismatch on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until force_break(). A live holder with another duration still raises (#900) by @​dxbjavid and @​gaborbernat.

PyPI release

Full Changelog

4.2.6

Bug fixes

  • Fix a race in SoftFileLock, MarkerSoftFileLock and SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (#899) by @​dxbjavid and @​gaborbernat.

PyPI release

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-10:

4.2.10 (2026-11-09)

.. _release-4-2-10-fixed:

Fixed

  • Contended :class:~filelock.FileLock and :class:~filelock.SoftFileLock acquisitions now raise :class:~filelock.Timeout when elapsed time reaches the requested timeout. A clock that landed exactly on the deadline previously left a waiter retrying with zero-length sleeps indefinitely (:pr:922) by :user:gaborbernat.

.. _release-4-2-10-packaging:

Packaging

  • Every wheel now carries a PEP 770 <https://peps.python.org/pep-0770/>_ CycloneDX SBOM in its .dist-info/sboms directory, written at build time by python-sbom <https://github.com/tox-dev/python-sbom>_ (:pr:921) by :user:gaborbernat.

.. _release-4-2-9:

4.2.9 (2026-11-04)

.. _release-4-2-9-fixed:

Fixed

  • :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

... (truncated)

Commits
  • 8803429 release 4.2.9
  • 030c5e2 🐛 fix(rw): reject a non-bool blocking (#908)
  • 90760d8 release 4.2.8
  • 19af0ad 👷 ci: adopt shared check, CodeQL and release workflows (#907)
  • 2ac1e92 📝 docs(descriptor): clarify native lock protocol compatibility (#905)
  • 6223054 build(deps): refresh project lock (#906)
  • bee5ab3 🔧 build(deps): refresh CI and docs tools (#904)
  • 825f3b5 👷 ci(scorecard): publish OpenSSF results (#903)
  • e386afb 🔧 build(deps): use release-creator 4.4 (#902)
  • 4257ca7 👷 ci(news): stop cancelling the news check (#901)
  • Additional commits viewable in compare view

Updates github-copilot-sdk from 1.0.22 to 1.0.29

Release notes

Sourced from github-copilot-sdk's releases.

v1.0.29

  • Defer allocator reclamation until disposed session data is released on opted-in Linux/glibc hosts, and preserve requests made during trim cooldown.
  • Sandbox deny rules support glob patterns, including hidden files and home-relative patterns, without changing literal grants.
  • Session-summary failure diagnostics omit private parent directories.
  • Start model requests without waiting for host event acknowledgements, while preserving stop-hook ordering and cancellation.
  • Reduced memory growth in non-streaming sessions by limiting retained transient events.
  • Session event-log reads now return promptly when a session disconnects instead of waiting for the long-poll timeout.
  • Fixed a bug where MCP, LSP, and plugin manifest files
  • Improved the Node.js SDK README by updating Permission
  • Runtime now prevents block compaction when buffers are
  • Custom subagents with private MCP connections avoid
  • Session metadata from getSessionMetadata and listSessions
  • Rust: Breaking: SessionMetadata adds client_name and
  • Fixed a bug where stop_bash could incorrectly report a
  • Fix Kerberos auth callback handling: .NET callbacks no
  • Node.js: a request whose params cannot be serialized no
  • Improve Claude token estimates used for session context
  • Sandbox blockedHosts now also match visible TLS SNI in
  • instructions.getDiscoveryPaths, skills.getDiscoveryPaths
  • Fixed a runtime bug where settings merges could overwrite
  • Local workspace diffs use the session's current working
  • Sandboxed Hugo commands receive Hugo and Go cache grants
  • Shell safety warnings are no longer duplicated as
  • Added validation for reasoning effort values before they
  • Improved runtime caching so MCP call results are preserved
  • Added SDK contracts to expose GitHub services through the
  • Keep credential assignments redacted across detached-shell
  • Added optional causal provenance to inter-agent session
  • Clarified errors when a managed sandbox cannot be
  • For authenticated github.com sessions, the runtime now
  • Eligible WorkIQ OAuth requests use the host's Entra
  • Expose Team marketplaces through plugin APIs.
  • Fix access to bundled search binaries in sandboxed SDK
  • Switching a concrete-model session to Auto now reconciles
  • Fusion model switches accept a null reasoning-effort reset
  • Sessions created with customAgents and
  • Requests can fall back to direct networking when system
  • Fixed a bug where hook configuration files encoded with a
  • Fixed a bug where LSP files matched by an empty extension
  • Java: The deprecated parentToolCallId property of the
  • Honor HTTP 429 Retry-After timing using existing request
  • Fixed an issue where setting session.mcp.disable after
  • Unlisted GPT models now use GPT-6.1 defaults, and unlisted
  • Java previews with the same base SDK version now update
  • Fixed plugin uninstall behavior so listed plugins can be
  • Sessions created on the standalone runtime host now return
  • Fixed a runtime bug where continuations with no usage were
  • Fixed premature extension readiness reporting that could
  • A session whose events cannot be persisted now emits a
  • Fixed an issue where failed HTTP MCP tool calls could

... (truncated)

Commits
  • 9bef53e Update SDK snapshot for Copilot CLI 1.0.107
  • c74ef96 Update SDK snapshot for Copilot CLI 1.0.106-11
  • 68b7db0 Update SDK snapshot for Copilot CLI 1.0.106-10
  • 99d90ed Revise README for Microsoft Copilot SDK transition (#2902)
  • c072001 Update SDK snapshot for Copilot CLI 1.0.106-9
  • d28a136 Update SDK snapshot for Copilot CLI 1.0.106-8
  • 90f11bf Update SDK snapshot for Copilot CLI 1.0.106-7
  • da61ce3 Update SDK snapshot for Copilot CLI 1.0.106-6
  • 0937135 Update SDK snapshot for Copilot CLI 1.0.106-5
  • 9504f1a Update SDK snapshot for Copilot CLI 1.0.106-4
  • Additional commits viewable in compare view

Updates ty from 0.0.97 to 0.0.99

Release notes

Sourced from ty's releases.

0.0.99

Release Notes

Released on 2026-11-06.

Bug fixes

  • Handle output errors when generating shell completions (#29997)
  • Invalidate aliased conditions across loop iterations (#30074)

LSP server

  • Add support for workspace/willRenameFiles LSP request (#28330)

Other changes

  • Bound comparisons of wide builtin literal unions (#30052)
  • Fix call argument validation for variadic parameters (#30086)
  • Freshen method typevars before owner specialization (#29543)
  • Inform call specializations compatibility through type context (#29932)
  • Keep source place IDs out of the use-def map (#30077)
  • Preserve type structure during typevar freshening (#29803)
  • Preserve typevars when mapping leaves their bounds unchanged (#29547)
  • Preserve unions inferred during fixpoint iteration (#29927)
  • Record lexical place IDs with their uses (#29956)
  • Skip existing release artifacts when retrying mirror uploads (#4937)
  • Skip fixpoint iteration for simple generic calls (#30054)
  • Solve generic call type context through constraint sets (#26680)

Contributors

Install ty 0.0.99

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.99/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.99/ty-installer.ps1 | iex"
</tr></table>

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.99

Released on 2026-11-06.

Bug fixes

  • Handle output errors when generating shell completions (#29997)
  • Invalidate aliased conditions across loop iterations (#30074)

LSP server

  • Add support for workspace/willRenameFiles LSP request (#28330)

Other changes

  • Bound comparisons of wide builtin literal unions (#30052)
  • Fix call argument validation for variadic parameters (#30086)
  • Freshen method typevars before owner specialization (#29543)
  • Inform call specializations compatibility through type context (#29932)
  • Keep source place IDs out of the use-def map (#30077)
  • Preserve type structure during typevar freshening (#29803)
  • Preserve typevars when mapping leaves their bounds unchanged (#29547)
  • Preserve unions inferred during fixpoint iteration (#29927)
  • Record lexical place IDs with their uses (#29956)
  • Skip existing release artifacts when retrying mirror uploads (#4937)
  • Skip fixpoint iteration for simple generic calls (#30054)
  • Solve generic call type context through constraint sets (#26680)

Contributors

0.0.98

Released on 2026-11-05.

Bug fixes

  • Avoid cubic narrowing for enum OR patterns (#30019)
  • Avoid duplicate warnings for unknown rules and override sections (#30028)
  • Fix class-pattern exhaustiveness after class identity checks (#30045)
  • Fix conditional type and tuple annotations (#29987)
  • Prefer active unnamed Conda and Pixi environments (#29974)
  • Preserve baseline matches when a rule is renamed (#30040)
  • Preserve exception types after tuple truthiness checks (#30018)

... (truncated)

Commits

Updates sse-starlette from 3.6.0 to 3.7.0

Release notes

Sourced from sse-starlette's releases.

v3.7.0

Fixed

  • A generator whose finally gets stuck after an encoding failure or an interrupted send no longer keeps the response open forever (#217). Previously the background task never ran, and uvicorn without a graceful timeout could not finish shutting down.
  • Body iterators are now closed when SSE event encoding fails, so generator cleanup runs before...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 11, 2026
Copilot AI balanced review requested due to automatic review settings November 11, 2026 12:59
Copilot AI reviewed Nov 11, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Relaxing the documented session-API compatibility cap requires confirming GitHubCopilotTarget support for SDK 1.0.23–1.0.29, but the SDK sources and runtime needed for validation are unavailable.

No open issues 🎉

What changed in this PR

This PR widens PyRIT’s optional GitHub Copilot SDK dependency range. The supplied diff only changes SDK constraints, despite the broader dependency-update description.

Changes:

  • Raises the SDK upper bound from <1.0.23 to <1.0.30, allowing versions through 1.0.29.
  • Keeps the github-copilot and all extras aligned while preserving the >=1.0.11 minimum.
File Description
pyproject.toml Widens the GitHub Copilot SDK version range in both optional dependency groups.

Review effort: Balanced

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.13, dev)

     1 files  ± 0       1 suites  ±0   8m 3s ⏱️ - 3m 32s
37 592 tests +37  37 149 ✅ +37  443 💤 ±0  0 ❌ ±0 
37 731 runs  +37  37 288 ✅ +37  443 💤 ±0  0 ❌ ±0 

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.11, dev)

     1 files  ± 0       1 suites  ±0   10m 14s ⏱️ + 3m 7s
37 592 tests +37  37 149 ✅ +37  443 💤 ±0  0 ❌ ±0 
37 731 runs  +37  37 288 ✅ +37  443 💤 ±0  0 ❌ ±0 

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.11, dev_all)

     1 files  ± 0       1 suites  ±0   11m 23s ⏱️ + 2m 0s
37 991 tests +37  37 900 ✅  - 28  26 💤 ±0  65 ❌ +65 
38 130 runs  +37  38 039 ✅  - 28  26 💤 ±0  65 ❌ +65 

For more details on these failures, see this check.

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.13, dev_all)

     1 files  ± 0       1 suites  ±0   7m 36s ⏱️ - 3m 57s
37 991 tests +37  37 900 ✅  - 28  26 💤 ±0  65 ❌ +65 
38 130 runs  +37  38 039 ✅  - 28  26 💤 ±0  65 ❌ +65 

For more details on these failures, see this check.

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.12, dev_all)

     1 files  ± 0       1 suites  ±0   12m 14s ⏱️ + 2m 53s
37 991 tests +37  37 900 ✅  - 28  26 💤 ±0  65 ❌ +65 
38 130 runs  +37  38 039 ✅  - 28  26 💤 ±0  65 ❌ +65 

For more details on these failures, see this check.

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.14, dev)

     1 files  ± 0       1 suites  ±0   9m 35s ⏱️ + 2m 48s
37 592 tests +37  37 149 ✅ +37  443 💤 ±0  0 ❌ ±0 
37 731 runs  +37  37 288 ✅ +37  443 💤 ±0  0 ❌ ±0 

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.12, dev)

     1 files  ± 0       1 suites  ±0   11m 20s ⏱️ + 1m 4s
37 592 tests +37  37 149 ✅ +37  443 💤 ±0  0 ❌ ±0 
37 731 runs  +37  37 288 ✅ +37  443 💤 ±0  0 ❌ ±0 

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.14, dev_all)

     1 files  ± 0       1 suites  ±0   6m 57s ⏱️ - 3m 55s
37 991 tests +37  37 900 ✅  - 28  26 💤 ±0  65 ❌ +65 
38 130 runs  +37  38 039 ✅  - 28  26 💤 ±0  65 ❌ +65 

For more details on these failures, see this check.

Results for commit 749ff0e. ± Comparison against base commit 907cf6b.

♻️ This comment has been updated with latest results.

@dependabot
MAINT: Bump the minor-and-patch group across 1 directory with 12 updates
7469e11 
Bumps the minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.4` | `3.14.5` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.162.0` | `0.162.2` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.14.2` | `2.14.3` |
| [pyodbc](https://github.com/mkleehammer/pyodbc) | `5.3.0` | `5.5.0` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.32` | `0.0.33` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.9.29` | `2026.11.7` |
| [transformers](https://github.com/huggingface/transformers) | `5.22.1` | `5.22.2` |
| [filelock](https://github.com/tox-dev/filelock) | `4.2.1` | `4.2.9` |
| [github-copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.22` | `1.0.29` |
| [ty](https://github.com/astral-sh/ty) | `0.0.97` | `0.0.99` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.6.0` | `3.7.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.3` | `0.17.4` |



Updates `aiohttp` from 3.14.4 to 3.14.5

Updates `fastapi` from 0.162.0 to 0.162.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.162.0...0.162.2)

Updates `pydantic` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.14.2...v2.14.3)

Updates `pyodbc` from 5.3.0 to 5.5.0
- [Release notes](https://github.com/mkleehammer/pyodbc/releases)
- [Commits](mkleehammer/pyodbc@5.3.0...5.5.0)

Updates `python-multipart` from 0.0.32 to 0.0.33
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.32...0.0.33)

Updates `regex` from 2026.9.29 to 2026.11.7
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.9.29...2026.11.7)

Updates `transformers` from 5.22.1 to 5.22.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.22.1...v5.22.2)

Updates `filelock` from 4.2.1 to 4.2.9
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.2.1...4.2.9)

Updates `github-copilot-sdk` from 1.0.22 to 1.0.29
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](github/copilot-sdk@v1.0.22...v1.0.29)

Updates `ty` from 0.0.97 to 0.0.99
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.97...0.0.99)

Updates `sse-starlette` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.6.0...v3.7.0)

Updates `ruff` from 0.17.3 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.3...0.17.4)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.162.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: filelock
  dependency-version: 4.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github-copilot-sdk
  dependency-version: 1.0.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pyodbc
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: python-multipart
  dependency-version: 0.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: regex
  dependency-version: 2026.11.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sse-starlette
  dependency-version: 3.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.99
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title MAINT: Bump the minor-and-patch group with 12 updates MAINT: Bump the minor-and-patch group across 1 directory with 12 updates Nov 11, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/minor-and-patch-b1f878b7f8 branch from 61302b0 to 7469e11 Compare November 11, 2026 20:20
@romanlutz @claude
MAINT: Rename ty ignore comments for rule rename in ty 0.0.99
749ff0e 
ty 0.0.99 renamed the `unresolved-import` rule to `import-not-found`,
turning every `# type: ignore[ty:unresolved-import]` comment into a
`renamed-rule-in-ignore-comment` error in the pre-commit ty hook.
Rename all 45 occurrences so the ty bump in this group needs no upper bound.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-code-quality[bot]
github-code-quality Bot found potential problems Nov 11, 2026
View reviewed changes
Comment thread pyrit/prompt_target/playwright_copilot_target.py
# Avoid errors for users who don't have playwright installed
if TYPE_CHECKING:
from playwright.async_api import Page # type: ignore[ty:unresolved-import]
from playwright.async_api import Page # type: ignore[ty:import-not-found]

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@github-code-quality github-code-quality[bot] github-code-quality[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@romanlutz