Skip to content

chore(deps)(deps): Bump the python-minor-patch group across 1 directory with 10 updates#134

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-28fdf09fcf
Closed

chore(deps)(deps): Bump the python-minor-patch group across 1 directory with 10 updates#134
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-28fdf09fcf

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 25, 2026 •
edited
Loading

Bumps the python-minor-patch group with 10 updates in the / directory:

Package From To
urllib3 2.6.3 2.7.0
pydantic 2.13.3 2.13.4
tox 4.53.1 4.54.0
ruff 0.15.12 0.15.14
openapi-spec-validator 0.8.5 0.9.0
openapi-python-client 0.28.3 0.28.4
poethepoet 0.45.0 0.46.0
ty 0.0.34 0.0.39
fastmcp 3.2.4 3.3.1
prefab-ui 0.19.1 0.20.1

Updates urllib3 from 2.6.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @​Cycloctane)
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @​kimkou2024)

    See GHSA-mf9v-mfxr-j63j for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @​christos-spearbit)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)
  • Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)
  • Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)
  • Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)
  • Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)
  • Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)
  • Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)
Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

    See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)
  • Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)
  • Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • See full diff in compare view

Updates tox from 4.53.1 to 4.54.0

Release notes

Sourced from tox's releases.

v4.54.0

What's Changed

Full Changelog: tox-dev/tox@4.53.1...4.54.0

Changelog

Sourced from tox's changelog.

Features - 4.54.0

  • Declare the runtime dependencies of the tox.pytest plugin (pytest, devpi-process and pytest-mock) under a new testing extra, so plugin authors can pull them in via tox[testing] - by :user:gaborbernat. (:issue:3938, :issue:3940)

Bug fixes - 4.54.0

  • Extend the generated TOML schema to cover every replace table form (env, ref, posargs, glob, if), including conditional replacements used inside commands. A guard test asserts the schema stays in sync with the loader implementation so future replace types cannot be added without a corresponding schema entry. (:issue:3939)

v4.53.1 (2026-05-02)

Commits
  • 1f1fcc7 release 4.54.0
  • b35c8ee 🐛 fix(schema): cover every replace form in the TOML schema (#3941)
  • 6eb5c4f ✨ feat(packaging): declare tox.pytest deps via a testing extra (#3940)
  • 1ad47dd 🧪 test(conftest): strip broken nspkg.pth files under py3.15 (#3937)
  • dfba966 [pre-commit.ci] pre-commit autoupdate (#3936)
  • 21069af [pre-commit.ci] pre-commit autoupdate (#3933)
  • See full diff in compare view

Updates ruff from 0.15.12 to 0.15.14

Release notes

Sourced from ruff's releases.

0.15.14

Release Notes

Released on 2026-05-21.

Preview features

  • [airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)
  • [flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)
  • [pylint] Implement too-many-try-statements (W0717) (#23970)
  • [ruff] Add incorrect-decorator-order (RUF074) (#23461)
  • [ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

  • Fix lambda formatting in interpolated string expressions (#25144)
  • Treat generic frozenset annotations as immutable (#25251)
  • [flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)
  • [pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

  • [flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)
  • [flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

  • Avoid unnecessary parser lookahead for operators (#25290)

Documentation

  • Update code example setting Neovim LSP log level (#25284)

Other changes

  • Add full PEP 798 support (#25104)
  • Add a parser recursion limit (#24810)
  • Update various ruff_python_stdlib APIs (#25273)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.14

Released on 2026-05-21.

Preview features

  • [airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#25152)
  • [flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#25086)
  • [pylint] Implement too-many-try-statements (W0717) (#23970)
  • [ruff] Add incorrect-decorator-order (RUF074) (#23461)
  • [ruff] Add fallible-context-manager (RUF075) (#22844)

Bug fixes

  • Fix lambda formatting in interpolated string expressions (#25144)
  • Treat generic frozenset annotations as immutable (#25251)
  • [flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#25035)
  • [pylint] Avoid false positives in else clause (PLR1733) (#25177)

Rule changes

  • [flake8-comprehensions] Skip C417 for lambdas with positional-only parameters (#25272)
  • [flake8-simplify] Preserve f-string source verbatim in SIM101 fix (#25061)

Performance

  • Avoid unnecessary parser lookahead for operators (#25290)

Documentation

  • Update code example setting Neovim LSP log level (#25284)

Other changes

  • Add full PEP 798 support (#25104)
  • Add a parser recursion limit (#24810)
  • Update various ruff_python_stdlib APIs (#25273)

Contributors

... (truncated)

Commits
  • 9ad2da3 Bump 0.15.14 (#25295)
  • c714e84 [ty] Modernize setup of union types in mdtests (#25291)
  • 8a8e35e [flake8-comprehensions] Skip C417 for lambdas with positional-only parame...
  • aea5ed4 Avoid unnecessary parser lookahead for operators (#25290)
  • e9d72bb [ty] Allow enum member accesses on self (#25077)
  • 6cbd59b Set exclude-newer = "7 days" in our PEP-723 scripts (#25285)
  • 9999a39 Update code example on how to update Neovim LSP log level (#25284)
  • 67d8c54 [ty] Retain recursively-defined state in binary expressions (#25277)
  • 25a3191 [ty] Refine Callable class-decorator fallback for unknown results (#25250)
  • c423054 Add a recursion limit to the parser (#24810)
  • Additional commits viewable in compare view

Updates openapi-spec-validator from 0.8.5 to 0.9.0

Release notes

Sourced from openapi-spec-validator's releases.

0.9.0

Upgrades

  • Upgrade schema-validator 0.9 #505
  • Upgrade jsonschema-path 0.5 #506

Backward incompatibilities

  • Validation results may change for specifications that previously relied on discriminator-based narrowing or on discriminator mapping resolution errors during validation. #505
Commits
  • 2121137 Version 0.9.0
  • ee4683b Merge pull request #506 from python-openapi/feature/upgrade-jsonschema-path-0.5
  • 692131c Upgrade jsonschema-path 0.5
  • 27cb341 Merge pull request #505 from python-openapi/feature/upgrade-schema-validator-...
  • 4413a52 Upgrade schema-validator 0.9
  • f407ed7 Merge pull request #484 from python-openapi/dependabot/pip/isort-8.0.1
  • 081f3be Bump isort from 8.0.0 to 8.0.1
  • d931faf Merge pull request #497 from python-openapi/dependabot/pip/mypy-1.20.2
  • f8c6261 Bump mypy from 1.19.1 to 2.1.0
  • 1b5dafd Merge pull request #500 from python-openapi/dependabot/pip/urllib3-2.7.0
  • Additional commits viewable in compare view

Updates openapi-python-client from 0.28.3 to 0.28.4

Release notes

Sourced from openapi-python-client's releases.

0.28.4 (2026-05-11)

Features

  • Update uv_build to 0.11 when using --meta=uv (#1434)

Add support for x-enum-varnames to string enums

#1358 by @​mbbush

You can now customize the variable names of the generated string enumerations using the x-enum-varnames openapi extension. Previously, this was only possible for integer enumerations.

Changelog

Sourced from openapi-python-client's changelog.

0.28.4 (2026-05-11)

Features

  • Update uv_build to 0.11 when using --meta=uv (#1434)

Add support for x-enum-varnames to string enums

##1358 by @​mbbush

You can now customize the variable names of the generated string enumerations using the x-enum-varnames openapi extension. Previously, this was only possible for integer enumerations.

Commits
  • 284576f Release 0.28.4 (#1408)
  • 7be999c chore(deps): lock file maintenance (#1415)
  • 7eeb915 chore(deps): update pypa/gh-action-pypi-publish action to v1.14.0 (#1419)
  • 894d9f4 chore(deps): update actions/upload-artifact action to v7.0.1 (#1422)
  • 5b25891 chore(deps): update dependency typer to >0.16,<0.26 (#1430)
  • dd2f095 feat: Update uv_build to 0.11 when using --meta=uv (#1434)
  • 5fcaf72 chore(deps): update actions/download-artifact action to v8.0.1 (#1414)
  • 75cb057 chore(deps): lock file maintenance (#1402)
  • 0534d3b chore(deps): update github artifact actions (major) (#1406)
  • 72a37ec Add support for x-enum-varnames to string enums (#1358)
  • See full diff in compare view

Updates poethepoet from 0.45.0 to 0.46.0

Release notes

Sourced from poethepoet's releases.

0.46.0

Enhancements

Fixes

Experimental agent skill

This release ships an experimental agent skill that gives AI coding agents contextual knowledge of poe's task API when working in projects that use it. It works with any agent that supports the skills convention and aims to improve agent abilities when it comes to leveraging and authoring poe tasks.

Please try it out and provide feedback!

Two install methods:

  1. Via a built in poe task (similar to how shell completions are installed):
poe _install_skill                          # auto-detects .claude/.codex/.pi/.agents and prompts
poe _install_skill ~/.claude/skills         # explicit path (substitute your agent's dir)
poe _install_skill <skills-dir> --upgrade   # non-interactive upgrade (skips if same/newer)
  1. From github via npx skills
npx skills add https://github.com/nat-n/poethepoet/tree/v0.46.0/poethepoet/skills/poethepoet

Full Changelog: nat-n/poethepoet@v0.45.0...v0.46.0

Commits
  • 23a4c1a feat: experimental Claude Code skill and bump-version task (#387)
  • a04a215 refactor: use AST for $POE_EXTRA_ARGS detection and cache parsed content (#388)
  • 61d2e34 refactor: use AST parser for all templating (#386)
  • 1bfad47 fix: make uv and poetry executors check for bat files (#385)
  • 35e4a1b fix: Strip underscore prefix in documentation for private positional args (#383)
  • See full diff in compare view

Updates ty from 0.0.34 to 0.0.39

Release notes

Sourced from ty's releases.

0.0.39

Release Notes

Released on 2026-05-22.

This release removes the Python 3.9 branches from our vendored standard library stubs. ty now only has "full" support for Python 3.10 and later, but will still report version-specific syntax errors and other diagnostics when --python-version 3.9 is provided via the CLI.

Bug fixes

  • Avoid panicking on __new__ assignments to classes (#25282)
  • Preserve declaration order when synthesizing class fields (#25249)
  • Respect dict-compatible fallbacks in TypedDict unions (#25242)
  • Retain recursively-defined state in binary expressions (#25277)

LSP server

  • Add Quick Fix to remove redundant cast (#25211)
  • Classify property declaration semantic tokens (#25322)
  • Escape HTML syntax in docstring rendering (#25247)
  • Prefer symbols from standard library over those of the same name from third party libraries for import completions. (#25108)
  • Support type aliases in document symbols (#25302)

Diagnostics

  • Add error context for extra callable parameters (#25269)

Performance

  • Avoid exponential blow-up in fall-through narrowing (#25278)
  • Speed up include filtering for projects with many literal include patterns (#25266)

Core type checking

  • Allow enum member accesses on self (#25077)
  • Emit a diagnostic for subclassing with order=True (#21704)
  • Full-scope bidirectional inference for unconstrained container literals (#25279)
  • Infer dict(TypedDict) as dict[str, object] (#24852)
  • Refine Callable class-decorator fallback for unknown results (#25250)
  • Reject incompatible explicit variance in generic base classes (#25327)
  • Support multi-inference through type aliases (#25245)
  • Sync vendored typeshed stubs (#25271, #25172)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.39

Released on 2026-05-22.

This release removes the Python 3.9 branches from our vendored standard library stubs. ty now only has "full" support for Python 3.10 and later, but will still report version-specific syntax errors and other diagnostics when --python-version 3.9 is provided via the CLI.

Bug fixes

  • Avoid panicking on __new__ assignments to classes (#25282)
  • Preserve declaration order when synthesizing class fields (#25249)
  • Respect dict-compatible fallbacks in TypedDict unions (#25242)
  • Retain recursively-defined state in binary expressions (#25277)

LSP server

  • Add Quick Fix to remove redundant cast (#25211)
  • Classify property declaration semantic tokens (#25322)
  • Escape HTML syntax in docstring rendering (#25247)
  • Prefer symbols from standard library over those of the same name from third party libraries for import completions. (#25108)
  • Support type aliases in document symbols (#25302)

Diagnostics

  • Add error context for extra callable parameters (#25269)

Performance

  • Avoid exponential blow-up in fall-through narrowing (#25278)
  • Speed up include filtering for projects with many literal include patterns (#25266)

Core type checking

  • Allow enum member accesses on self (#25077)
  • Emit a diagnostic for subclassing with order=True (#21704)
  • Full-scope bidirectional inference for unconstrained container literals (#25279)
  • Infer dict(TypedDict) as dict[str, object] (#24852)
  • Refine Callable class-decorator fallback for unknown results (#25250)
  • Reject incompatible explicit variance in generic base classes (#25327)
  • Support multi-inference through type aliases (#25245)
  • Sync vendored typeshed stubs (#25271, #25172)

Contributors

... (truncated)

Commits

Updates fastmcp from 3.2.4 to 3.3.1

Release notes

Sourced from fastmcp's releases.

v3.3.1: Loop There It Is

FastMCP 3.3.1 is a hotfix for the 3.3 packaging split. Clean installs of 3.3.0 could fail on standalone component imports like from fastmcp.tools import tool because component modules reached auth and task primitives through fastmcp.server, pulling in the server/provider stack and exposing a circular import.

Component-level auth and task primitives now live in lightweight utility modules, with the old server import paths preserved as compatibility re-exports. Component imports stay lightweight, existing server-facing imports continue to work, and the release also includes small docs corrections from the 3.3 rollout.

What's Changed

Fixes 🐞

Full Changelog: PrefectHQ/fastmcp@v3.3.0...v3.3.1

v3.3.0: Slim Reaper

FastMCP 3.3 ships fastmcp-slim, a new lightweight distribution that separates the client from the server stack. It also closes out a meaningful backlog of security hardening, observability improvements, and auth additions that accumulated through the 3.2 cycle.

fastmcp-slim

The full FastMCP package pulls in Starlette, Uvicorn, and the rest of the server machinery — necessary for running a server, but wasteful if you're writing a client, a script, or an agent that just needs to talk to MCP. fastmcp-slim is a dependency-light distribution that ships the client and transport layer without any of that.

The import namespace is unchanged:

from fastmcp import Client
async with Client("https://example.com/mcp") as client:
result = await client.call_tool("my_tool", {"arg": "value"})

Install fastmcp-slim[client] anywhere you want FastMCP's client without the server footprint — CI environments, lightweight agents, library dependencies that shouldn't force Uvicorn on downstream users.

Security

The OAuth proxy received three hardening upgrades. Silent consent is now guarded against AS-in-the-middle attacks — a malicious authorization server can no longer silently approve a consent it wasn't meant to handle. Redirect URI allowlist matching now rejects dot-segment paths (/../, /./) that could otherwise bypass prefix checks. And ResponseCachingMiddleware partitions its cache by access token, closing a gap where different users could see each other's cached responses.

Auth

AzureB2CProvider adds first-class support for Azure AD B2C user flows. The OCI provider is fixed for 3.x installs. And OAuthProxy gains a public update_scopes() API for updating the proxy's required scopes after initialization — useful for servers that determine scope requirements at runtime.

Observability

OTEL instrumentation is now fully compliant with MCP semantic conventions. List operations (list_tools, list_resources, list_prompts, list_resource_templates) are instrumented, and delegate spans on proxy servers are enriched with backend attributes.

Thread Affinity

Sync tools run in a thread pool by default. If your tool holds thread-local state or is bound to a specific thread (UI frameworks, some database drivers), you can now opt out:

... (truncated)

Commits
  • d8dcc27 Decouple component imports from server (#4150)
  • 255e3e4 fix(docs): use valid FA icon on client-only package page (#4139)
  • 73df4dc chore: Update SDK documentation (#4096)
  • ee48a0f Refine fastmcp-slim packaging (#4125)
  • bb4894d Add fastmcp-slim for client-only installs (#4122)
  • 8209093 fix(http): terminate active streamable-HTTP transports before lifespan shutdo...
  • cf59a45 Fix OCI Provider issue in 3.x version. Add OCI auth provider example … (#4116)
  • 89b99ec fix(proxy): fall back to live identifier for backend_* span attributes (#4109)
  • 310314c fix: cli option --no-banner is NOT passed to cli but server-spec in-correctly...
  • 28722f8 fix: drop exc_info for expected tool failures, remove unreachable ValidationE...
  • Additional commits viewable in compare view

Updates prefab-ui from 0.19.1 to 0.20.1

Release notes

Sourced from prefab-ui's releases.

v0.20.1: Wire Fraud

What's Changed

Full Changelog: PrefectHQ/prefab@v0.20.0...v0.20.1

v0.20.0: Wire Transfer

What's Changed

Full Changelog: PrefectHQ/prefab@v0.19.2...v0.20.0

v0.19.2: Results May Vary

What's Changed

Full Changelog: PrefectHQ/prefab@v0.19.1...v0.19.2

Commits
  • 17719b8 Downgrade recent renderer dependencies (#456)
  • 14f5185 Align sortable DataTable headers (#455)
  • 08ba291 Support latest ty (#452)Description has been truncated

@dependabot
chore(deps)(deps): Bump the python-minor-patch group across 1 directo…
03a4d72 
…ry with 10 updates

Bumps the python-minor-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.3` | `2.13.4` |
| [tox](https://github.com/tox-dev/tox) | `4.53.1` | `4.54.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.14` |
| [openapi-spec-validator](https://github.com/python-openapi/openapi-spec-validator) | `0.8.5` | `0.9.0` |
| [openapi-python-client](https://github.com/openapi-generators/openapi-python-client) | `0.28.3` | `0.28.4` |
| [poethepoet](https://github.com/nat-n/poethepoet) | `0.45.0` | `0.46.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.34` | `0.0.39` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.2.4` | `3.3.1` |
| [prefab-ui](https://github.com/PrefectHQ/prefab) | `0.19.1` | `0.20.1` |



Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

Updates `pydantic` from 2.13.3 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.3...v2.13.4)

Updates `tox` from 4.53.1 to 4.54.0
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.53.1...4.54.0)

Updates `ruff` from 0.15.12 to 0.15.14
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.12...0.15.14)

Updates `openapi-spec-validator` from 0.8.5 to 0.9.0
- [Release notes](https://github.com/python-openapi/openapi-spec-validator/releases)
- [Commits](python-openapi/openapi-spec-validator@0.8.5...0.9.0)

Updates `openapi-python-client` from 0.28.3 to 0.28.4
- [Release notes](https://github.com/openapi-generators/openapi-python-client/releases)
- [Changelog](https://github.com/openapi-generators/openapi-python-client/blob/main/CHANGELOG.md)
- [Commits](openapi-generators/openapi-python-client@v0.28.3...v0.28.4)

Updates `poethepoet` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/nat-n/poethepoet/releases)
- [Commits](nat-n/poethepoet@v0.45.0...v0.46.0)

Updates `ty` from 0.0.34 to 0.0.39
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.34...0.0.39)

Updates `fastmcp` from 3.2.4 to 3.3.1
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.2.4...v3.3.1)

Updates `prefab-ui` from 0.19.1 to 0.20.1
- [Release notes](https://github.com/PrefectHQ/prefab/releases)
- [Commits](PrefectHQ/prefab@v0.19.1...v0.20.1)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: tox
  dependency-version: 4.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.15.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: openapi-spec-validator
  dependency-version: 0.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: openapi-python-client
  dependency-version: 0.28.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: poethepoet
  dependency-version: 0.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ty
  dependency-version: 0.0.39
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: prefab-ui
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 25, 2026

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Jun 2, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 2, 2026
@dependabot dependabot Bot deleted the dependabot/uv/python-minor-patch-28fdf09fcf branch June 2, 2026 03:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants