Skip to content

deps(python): Bump the python-minor group with 6 updates - #11634

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-01ff274c82
Open

deps(python): Bump the python-minor group with 6 updates#11634
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-01ff274c82

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor group with 6 updates:

Package From To
fastmcp 4.0.0b5 4.0.2
alembic 1.19.1 1.19.2
anthropic 1.2.0 1.3.0
cachetools 7.1.7 7.1.8
ruff 0.16.5 0.16.6
kaleido 1.3.0 1.4.0

Updates fastmcp from 4.0.0b5 to 4.0.2

Release notes

Sourced from fastmcp's releases.

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.1...v4.0.2

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

What's Changed

Fixes 🐞

Docs 📚

Other Changes 🦾

Full Changelog: PrefectHQ/fastmcp@v4.0.0...v4.0.1

v4.0.0: Four Real

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

  • Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
  • Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
  • Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

Enhancements ✨

Fixes 🐞

Docs 📚

  • docs: point What's New at the changelog for later releases by @​zzstoatzz in #4992
  • docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in #4988

New Contributors

Full Changelog: v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

Fixes 🐞

Docs 📚

Full Changelog: v4.0.1...v4.0.2

... (truncated)

Commits
  • 8d52974 docs: add v4.0.2 changelog entries (#4990)
  • 07659a0 skills: add release skill with changelog entry helper (#4982)
  • fbe04c7 Expose ClientGroup from package root (#4987)
  • 07d7c54 docs: link the FastMCP 4 GA announcement and blog from What's New and Updates...
  • 94078f1 docs: note the 4.0.1 floor for ClientGroup reentrancy (#4980)
  • c4d9b68 docs: escape <1 in changelog so MDX parses (#4978)
  • b46cd58 docs: add v4.0.1 changelog entries (#4976)
  • 5c679ba client: make ClientGroup context reentrant (#4975)
  • 62ef226 docs: refresh sidebar tags and fix audit findings across servers/clients page...
  • 4f33763 docs: drop prerelease install framing from installation and SDK migration gui...
  • Additional commits viewable in compare view

Updates alembic from 1.19.1 to 1.19.2

Release notes

Sourced from alembic's releases.

1.19.2

Released: September 4, 2026

changed

  • [changed] [autogenerate] The autogenerate plugin for CHECK constraint detection by name, added in 1.19.0. for #508, is no longer enabled by default. It has been renamed from alembic.autogenerate.checkconstraint_byname to alembic.ext.checkconstraint_byname and no longer matches on the "alembic.autogenerate.*" wildcard, which remains the default plugin specification. The previous name will still function as well if placed in the plugins list explicitly, both to enable the plugin and within a "~" exclusion, so that an env.py written against 1.19.0 or 1.19.1 requires no change.

    The plugin is now recommended only for schemas that ensure the naming of all constraints using a client side naming convention, otherwise there's a persistent risk of false positives. See autogenerate_check_constraints for background on things to be aware of when using this plugin.

    As part of this change "type bound" CHECK constraints, which include constraints generated for the Boolean and Enum datatypes when the create_constraint parameter is set to True, are no longer ignored in the metadata side, so that normal name-based matching can occur for these constraints.

    References: #1859

usecase

  • [usecase] [autogenerate] [batch] The target of a ~sqlalchemy.schema.ForeignKey is now located using the ForeignKey.target_tokens and ForeignKey.target_table_key accessors added in SQLAlchemy 2.1, rather than by splitting the dotted string form of that target on ".". As a dot inside a schema, table or column name cannot be told apart from the separator between those names, a foreign key whose target name contained a dot was previously mis-parsed by autogenerate rendering as well as by batch migrations. The dotted string continues to be split when running against SQLAlchemy 2.0, where these accessors are not present. Thanks to Gyanu Mayank for the initial pull request.

    References: #1860

Commits

Updates anthropic from 1.2.0 to 1.3.0

Release notes

Sourced from anthropic's releases.

v1.3.0

1.3.0 (2026-09-01)

Full Changelog: v1.2.0...v1.3.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (74080c3)
  • api: manual updates (1dc3ce0)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (429e719)

Bug Fixes

  • aws: resolve base_url from aws_region under skip_auth and with_options (#564) (b6d1732)
  • batches: add results to GA raw/streaming response wrappers (cbf9715)
  • ci: don't hard-wrap detect-breaking-changes output (b5be779)
  • client: derive multipart filename for file tuples passed without one (a9f3fb4)
  • types: remove unused wire aliases from header and path params (dc0a9ab)

Chores

  • internal: drop the unused discriminator argument from PropertyInfo (3dae6fd)
  • internal: drop the unused distro dependency (a47d85f)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1900) (7c84e13)

Refactors

  • types: mark discriminated unions with UnionDiscriminator instead of PropertyInfo (17df0bf)
  • types: use UnionDiscriminator for more discriminated unions (b44af2c)
Changelog

Sourced from anthropic's changelog.

1.3.0 (2026-09-01)

Full Changelog: v1.2.0...v1.3.0

Features

  • api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (74080c3)
  • api: manual updates (1dc3ce0)
  • api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (429e719)

Bug Fixes

  • aws: resolve base_url from aws_region under skip_auth and with_options (#564) (b6d1732)
  • batches: add results to GA raw/streaming response wrappers (cbf9715)
  • ci: don't hard-wrap detect-breaking-changes output (b5be779)
  • client: derive multipart filename for file tuples passed without one (a9f3fb4)
  • types: remove unused wire aliases from header and path params (dc0a9ab)

Chores

  • internal: drop the unused discriminator argument from PropertyInfo (3dae6fd)
  • internal: drop the unused distro dependency (a47d85f)

Documentation

  • changelog: detail the beta files/skills GA-shape change (#1900) (7c84e13)

Refactors

  • types: mark discriminated unions with UnionDiscriminator instead of PropertyInfo (17df0bf)
  • types: use UnionDiscriminator for more discriminated unions (b44af2c)
Commits
  • 370ee92 release: 1.3.0
  • b132569 feat(api): manual updates
  • 665dae8 fix(types): remove unused wire aliases from header and path params
  • 825dbb9 fix(client): derive multipart filename for file tuples passed without one
  • 2d81a47 fix(ci): don't hard-wrap detect-breaking-changes output
  • 23d68ee feat(api): organization compliance settings, user-profile order_by, memory-st...
  • f21982a fix(aws): resolve base_url from aws_region under skip_auth and with_options (...
  • e7e0c00 fix(batches): add results to GA raw/streaming response wrappers
  • 1280f2c chore(internal): drop the unused discriminator argument from PropertyInfo
  • 72cac10 refactor(types): use UnionDiscriminator for more discriminated unions
  • Additional commits viewable in compare view

Updates cachetools from 7.1.7 to 7.1.8

Changelog

Sourced from cachetools's changelog.

v7.1.8 (2026-08-31)

  • Reject negative maxsize in Cache.__init__.
Commits
  • 4500e3d Release v7.1.8.
  • 6e49bef Update copilot instructions and review.
  • defc58b Prepare v7.1.8.
  • a39180b Remove somewhat superfluous and slightly incorrect documentation note regardi...
  • dd181c5 Reject negative maxsize in Cache.init
  • b43b953 Use monthly batches for dependabot updates.
  • See full diff in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates kaleido from 1.3.0 to 1.4.0

Release notes

Sourced from kaleido's releases.

v1.4.0

Fixed

  • Fix TypeError: Type is not JSON serializable: Timestamp when a figure contains datetime-like values such as a pandas Timestamp; these now serialize to ISO strings [#461], with thanks to @​binggao1230 for the contribution!
  • Fix orjson serialization of Decimal values [[issue #453](plotly/Kaleido#453

Changed

  • Switch default MathJax version from v2 to v3 [#469]
Changelog

Sourced from kaleido's changelog.

v1.4.0

Fixed

  • Fix TypeError: Type is not JSON serializable: Timestamp when a figure contains datetime-like values such as a pandas Timestamp; these now serialize to ISO strings [#461], with thanks to @​binggao1230 for the contribution!
  • Fix orjson serialization of Decimal values [[issue #453](plotly/Kaleido#453

Changed

  • Switch default MathJax version from v2 to v3 [#469]
Commits
  • 90be50a Merge pull request #473 from plotly/release-v1.4.0
  • 0a2a0ab use official astral ruff workflow and pin ruff version
  • 1733e0e update changelog for v1.4.0
  • aedf5d7 Merge pull request #452 from plotly/dependabot/uv/src/py/uv-c30c77f42d
  • 833baa7 Merge pull request #460 from plotly/dependabot/npm_and_yarn/src/js/npm_and_ya...
  • 73732d4 Merge pull request #469 from plotly/default-mathjax-v3
  • ae6f856 Merge branch 'main' into default-mathjax-v3
  • cd2c1af update changelog
  • 27219ad Merge pull request #461 from gaoflow/fix-458-datetime-serialization
  • f5f6b69 Update CHANGELOG
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(python): Bump the python-minor group with 6 updates
975b311 
Bumps the python-minor group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `4.0.0b5` | `4.0.2` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.19.1` | `1.19.2` |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `1.2.0` | `1.3.0` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.7` | `7.1.8` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.6` |
| [kaleido](https://github.com/plotly/kaleido) | `1.3.0` | `1.4.0` |


Updates `fastmcp` from 4.0.0b5 to 4.0.2
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.0.0b5...v4.0.2)

Updates `alembic` from 1.19.1 to 1.19.2
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `anthropic` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v1.2.0...v1.3.0)

Updates `cachetools` from 7.1.7 to 7.1.8
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.1.7...v7.1.8)

Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `kaleido` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/plotly/kaleido/releases)
- [Changelog](https://github.com/plotly/Kaleido/blob/main/CHANGELOG.md)
- [Commits](plotly/Kaleido@v1.3.0...v1.4.0)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: alembic
  dependency-version: 1.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: anthropic
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: cachetools
  dependency-version: 7.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: kaleido
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants