fix(deps): update all non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	7.3.1 → 7.3.2
cloud.google.com/go/storage	v1.67.0 → v1.67.1
golang.org/x/oauth2	v0.36.0 → v0.37.0
golang.org/x/text	v0.41.0 → v0.42.0
google-api-core	==2.34.0 → ==2.36.0
google-cloud-discoveryengine (source)	==0.13.12 → ==0.20.3
google-cloud-storage (source)	==3.13.1 → ==3.14.1
marked (source)	18.0.11 → 18.0.12
mcp	==1.29.1 → ==1.30.0
narwhals	==2.25.0 → ==2.26.0
numpy (changelog)	==2.5.2 → ==2.5.3
opentelemetry-api	==1.42.1 → ==1.44.0
opentelemetry-exporter-otlp-proto-common	==1.42.1 → ==1.44.0
opentelemetry-exporter-otlp-proto-http	==1.42.1 → ==1.44.0
opentelemetry-proto	==1.42.1 → ==1.44.0
opentelemetry-sdk	==1.42.1 → ==1.44.0
platformdirs (changelog)	==4.11.7 → ==4.11.8
pydantic-core	==2.46.5 → ==2.48.0
rich-toolkit	==0.20.4 → ==0.20.5
tifffile (source)	==2026.8.23 → ==2026.9.9

---

Release Notes

withastro/astro (astro)

v7.3.2

Compare Source

Patch Changes

• #​17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #​17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #​17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #​17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@0.4.1

googleapis/google-cloud-go (cloud.google.com/go/storage)

v1.67.1: storage: v1.67.1

Bug Fixes

• storage: Prevent panic when MultiRangeDownloader callback is nil (#​20377) (a85e955)

googleapis/google-cloud-python (google-api-core)

v2.36.0: google-cloud-bigquery-storage 2.36.0

Compare Source

Features

• auto-enable mTLS when supported certificates are detected (PiperOrigin-RevId: 8454486) (d2b35b25)

• check Python and dependency versions in generated GAPICs (PiperOrigin-RevId: 8454486) (d2b35b25)

v2.35.0: google-cloud-bigquery-storage 2.35.0

Compare Source

Features

• Support picosecond timestamp precision in BigQuery Storage API (PiperOrigin-RevId: 8294868) (5093802d)

markedjs/marked (marked)

v18.0.12

Compare Source

modelcontextprotocol/python-sdk (mcp)

v1.30.0

Compare Source

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#​3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#​3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#​3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#​3431, #​3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#​3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#​3431).
• session_idle_timeout= and max_sessions= on FastMCP (#​3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in #​3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in #​3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in #​3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in #​3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in #​3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

narwhals-dev/narwhals (narwhals)

v2.26.0: Narwhals v2.26.0

Compare Source

Changes

🚀 Performance improvements

• perf: Avoid getting columns to read dtypes, route bare selectors through simple_select (#​3875)
• perf: Speedup pandas-like is_finite, sqrt, kurtosis and skew (#​3874)

✨ Enhancements

• feat: Improve error message on unsupported length-changing methods (#​3903)

🐞 Bug fixes

• fix(pyarrow): strip_chars with empty characters no longer strips whitespace (#​3925)
• ci: fix downstream pins for pointblank (#​3922)
• fix: use dtype.categories for pl.Enum in get_categories (#​3924)
• fix(typing): Stableify selectors (#​3904)
• fix(typing): Stableify concat with the stable frame classes (#​3908)
• fix(pyarrow): shift preserves length when n exceeds the series length (#​3920)
• fix(pyarrow): keep nulls through clip instead of replacing them with a bound (#​3906)
• fix: Deprecate cat.get_categories and stop relying on Polars' removed method (#​3902)
• fix: inplace deprecation warning from pandas in hist (#​3907)
• fix(test): xfail polars v2 for is_in and __contains__ tests (#​3901)
• fix(test): Fix interchange and concat tests (#​3896)
• fix: str.slice(..., length=0) returns empty string on pandas and dask (#​3891)

📖 Documentation

• docs: Resync documentation with implementation (#​3820)
• docs: Add AGENTS.md (#​3821)

🛠️ Other improvements

• chore: prek autoupdate (#​3928)
• chore: prek autoupdate (#​3894)
• chore(typing): Remove redundant {cast,bool,str} calls (#​3905)
• test: xfail test_unique_expr for duckdb 1.6+ (#​3899)
• chore: remove unnecessary import (#​3881)
• refactor(typing): use closed=True in some TypedDicts (#​3800)
• test: add simple test to measure Narwhals vs pandas overhead (#​3873)
• chore: prek autoupdate (#​3876)

Thank you to all our contributors for making this release possible!
@​FBruzzesi, @​heyilingran, @​MarcoGorelli, @​ptimizeroracle, @​winklemad, @​github-actions[bot], @​dangotbanned, @​EdAbati and ptimizeroracle

numpy/numpy (numpy)

v2.5.3

Compare Source

open-telemetry/opentelemetry-python (opentelemetry-api)

v1.44.0

Compare Source

Added

• opentelemetry-docker-tests: Refactor Docker tests to properly validate
  contents of exported telemetry
  (#​5220)
• opentelemetry-exporter-otlp-common: add shared package for common OTLP
  utilities
  (#​5252)
• opentelemetry-sdk: add MissingDependencyError exception for declarative
  configuration and use it for missing optional dependency errors
  (#​5265)
• opentelemetry-sdk: Add ability to refresh process dependent Resource
  attributes
  (#​5280)
• opentelemetry-sdk: add force_flush method to LogRecordExporter ABC
  (#​5294)
• opentelemetry-sdk: Make it possible to limit the size of stored spans in
  InMemorySpanExporter
  (#​5296)
• opentelemetry-sdk: add log record limits environment variables
  OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT and
  OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT
  (#​5300)
• opentelemetry-sdk: add support for file exporter with declarative config
  (#​5311)
• opentelemetry-sdk: expose SynchronousMultiLogRecordProcessor and
  ConcurrentMultiLogRecordProcessor publicly
  (#​5327)
• opentelemetry-sdk: point the declarative configuration package README at
  the shared language support status
  matrix
  in the opentelemetry-configuration repo, so Python conformance status lives
  alongside the other languages instead of being duplicated per language SDK.
  (#​5347)
• opentelemetry-sdk: document that Python-implementation extensions
  (OTEL_PYTHON_* variables) are bypassed when OTEL_CONFIG_FILE is set. The
  env-var initialisation path is skipped entirely in favour of the declarative
  file; honouring these alongside a config file is tracked as a follow-up.
  (#​5353)
• opentelemetry-sdk: wire id_generator from declarative configuration to
  TracerProvider
  (#​5363)
• opentelemetry-sdk: Add support for activating instrumentors from a
  declarative configuration file via the instrumentation/development.python
  section. Instrumentors can declare a configuration attribute to have their
  options validated through the same type-coercion pipeline used for SDK
  component configuration.
  (#​5372)
• opentelemetry-sdk: add record_min_max option to
  ExponentialBucketHistogramAggregation, matching the option already
  available on ExplicitBucketHistogramAggregation and required by the
  specification
  (#​5377)

Changed

• opentelemetry-sdk: revert BoundedAttributes RLock back to Lock
  (#​5329)
• docs: update logs example to use opentelemetry-instrumentation-logging
  (#​5344)
• opentelemetry-sdk: bump declarative configuration schema to v1.1.0
  (#​5345)
• opentelemetry-configuration: declarative configuration moves from
  opentelemetry.sdk._configuration into the new public
  opentelemetry-configuration package (opentelemetry.configuration
  namespace), published experimentally. opentelemetry-sdk[file-configuration]
  continues to work as an alias that installs opentelemetry-configuration
  alongside the SDK.
  (#​5356)
• opentelemetry-api: remove env carrier environment snapshot caching, you now
  have to pass explicitly the mapping where to get the environment variables
  from as the EnvironmentGetter.get first argument.
  (#​5366)
• opentelemetry-semantic-conventions: bump to 1.42.0
  (#​5410)
• opentelemetry-semantic-conventions: bump to 1.43.0
  (#​5413)

Removed

• opentelemetry-api, opentelemetry-sdk: Removed deprecated Events API/SDK.
  Use LogRecord with the event_name field set instead.
  (#​5293)

Fixed

• opentelemetry-sdk: Optimize LogRecord memory in BatchLogRecordProcessor
  by clearing the Context object before buffering. This is a potentially
  breaking change for custom log exporters that access context from the
  exported ReadableLogRecord, as the context will now be an empty Context()
  instead of the original.
  (#​4977)
• opentelemetry-sdk: drop non-finite measurements (NaN and Inf) at the
  instrument level to prevent permanent aggregation poisoning
  (#​5336)
• opentelemetry-sdk: raise ValueError when
  ExplicitBucketHistogramAggregation boundaries are not strictly increasing
  or finite
  (#​5340)
• opentelemetry-sdk: ProcessResourceDetector no longer collects or emits
  process.command_args and process.command_line by default since the values
  are not sanitized and may contain sensitive information. Users who depend
  on these resource attributes must pass include_command_args=True.
  (#​5364)
• opentelemetry-exporter-otlp-proto-http: fix the OTLP HTTP metric exporter
  self-observability metrics over-counting data points when
  max_export_batch_size splits a batch; each split now reports its own
  data-point count instead of the whole-batch count.
  (#​5370)
• opentelemetry-api: Prevent in-place mutation of Context via inherited
  dict methods
  (#​5399)

v1.43.0

Compare Source

Added

• opentelemetry-sdk: add add_metric_reader / remove_metric_reader public
  APIs to register / unregister metric readers at runtime.
  (#​4863)
• opentelemetry-exporter-prometheus: add support for configuring metric scope
  labels
  (#​5123)
• opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log
  message that's written when the grpc call fails.
  (#​5143)
• opentelemetry-exporter-http-transport: add
  'opentelemetry-exporter-http-transport' package for HTTP exporters
  (#​5194)
• opentelemetry-sdk: Add composite/development samplers support to
  declarative file configuration
  (#​5201)
• opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter
  implementation
  (#​5207)
• opentelemetry-sdk: add _resolve_component shared utility for declarative
  config plugin loading, reducing boilerplate in exporter factory functions
  (#​5215)
• opentelemetry-sdk: add pull metric reader support to declarative file
  configuration, including Prometheus metric reader via the
  prometheus_development config field
  (#​5216)
• opentelemetry-proto-json: update to use opentelemetry-proto v1.10.0
  (#​5224)
• opentelemetry-proto: bump maximum supported protobuf version to 7.x.x
  (#​5251)
• opentelemetry-sdk: add ServiceInstanceIdResourceDetector for populating
  service.instance.id
  (#​5259)
• opentelemetry-sdk: declarative config loader now recursively converts
  parsed dicts into typed dataclass instances, including nested dataclasses,
  lists of dataclasses, and enum values. End-to-end YAML/JSON → SDK
  configuration now works via the factory functions.
  (#​5269)
• opentelemetry-sdk: add configure_sdk(config) to the declarative
  configuration API. Single entry point that takes a parsed
  OpenTelemetryConfiguration, builds the resource, and applies the
  tracer/meter/logger providers and propagator globally. Honors the top-level
  disabled flag.
  (#​5270)
• opentelemetry-sdk: the SDK configurator now honors the OTEL_CONFIG_FILE
  environment variable. When set, the SDK loads and applies the referenced
  declarative configuration file (YAML or JSON) in place of the env-var-based
  init path.
  (#​5271)
• opentelemetry-sdk: update declarative config to use
  ServiceInstanceIdResourceDetector
  (#​5299)
• opentelemetry-exporter-otlp-proto-common,
  opentelemetry-exporter-otlp-json-common: encoders now always accept null,
  and encode it as an empty AnyValue in accordance with the spec.
  (#​5305)
• opentelemetry-sdk: validate the declarative config file_format version —
  reject an unsupported major version and warn on a newer minor version, per
  the configuration spec versioning rules
  (#​5315)
• opentelemetry-exporter-http-transport: enable entry-point loading of
  transport implementations
  (#​5320)

Changed

• opentelemetry-sdk: introduce experimental entry points for OpAMP agent
  integration
  (#​4646)
• opentelemetry-api: conditionally import entrypoints for
  opentelemetry_context only if the OTEL_PYTHON_CONTEXT env variable is
  defined, return ContextVarsRuntimeContext otherwise
  (#​5144)
• opentelemetry-sdk: rename "known/unknown" to "built-in/user-defined"
  terminology in declarative config component loading code
  (#​5214)
• opentelemetry-proto: regenerate protobuf code from opentelemetry-proto
  v1.10.0
  (#​5223)
• opentelemetry-sdk: remove unnecessary copy in Span creation
  (#​5272)
• opentelemetry-sdk: remove unnecessary dict in set_attribute method
  (#​5274)
• opentelemetry-sdk: inline the method _clean_attribute_value
  (#​5275)
• Remove typing aliases deprecated in python 3.9 and replace all usages of
  typing.Union and typing.Optional with |.
  (#​5277)
• opentelemetry-sdk: remove generator in the accessor for links/events
  (#​5287)
• opentelemetry-api: remove unnecessary copy in iterator
  (#​5288)
• opentelemetry-api: update EnvironmentGetter to ignore non-normalized
  environment variable names
  (#​5289)
• opentelemetry-sdk: update iterator for BoundedList
  (#​5297)
• opentelemetry-sdk: reduce lock contention in attributes
  (#​5298)
• opentelemetry-sdk: merge doesn't need a copy, dict already does this
  (#​5326)
• opentelemetry-api: normalize empty environment propagation names to _ in
  EnvironmentSetter and EnvironmentGetter
  (#​5328)

Fixed

• Add missing .rst files to Sphinx documentation build for SDK logs,
  propagators, and exporter submodules.
  (#​5017)
• Preserve the random trace ID flag when creating child spans instead of always
  setting the random trace id bit depending on the available trace id
  generator.
  (#​5241)
• opentelemetry-api: fix SelectableGroups deprecation warning
  (#​5250)
• opentelemetry-sdk: make
  SynchronousMeasurementConsumer.consume_measurement lock free to avoid
  deadlocks
  (#​5321)

tox-dev/platformdirs (platformdirs)

v4.11.8

Compare Source

cgohlke/tifffile (tifffile)

v2026.9.9

Compare Source

Read and write TIFF files

Tifffile is a comprehensive Python library to

1. store NumPy arrays in TIFF (Tagged Image File Format) files, and
2. read image and metadata from TIFF-like files used in bioimaging.

Image and metadata can be read from TIFF, BigTIFF, OME-TIFF, GeoTIFF, Adobe DNG, ZIF (Zoomable Image File Format), MetaMorph STK, Zeiss LSM, ImageJ hyperstack, Micro-Manager MMStack and NDTiff, SGI, NIHImage, FLIMage, Olympus FluoView and SIS, ScanImage, Molecular Dynamics GEL, Huron TIFF, Aperio SVS, Leica SCN, Roche BIF, PerkinElmer QPTIFF (QPI, PKI), Hamamatsu NDPI, Argos AVS, Philips DP, DICOM-TIFF, and ThermoFisher EER formatted files.

Image data can be read as NumPy arrays or Zarr arrays/groups from strips, tiles, pages (IFDs), SubIFDs, higher order series, and pyramidal levels.

Image data can be written to TIFF, BigTIFF, OME-TIFF, and ImageJ hyperstack compatible files in multi-page, volumetric, pyramidal, memory-mappable, tiled, predicted, or compressed form.

Many compression and predictor schemes are supported via the imagecodecs library, including LZW, PackBits, Deflate, CCITT, PIXTIFF, LZMA, LERC, Zstd, JPEG (8 and 12-bit, lossless), JPEG 2000, JPEG XR, JPEG XL, WebP, PNG, EER, Jetraw, 24-bit floating-point, and horizontal differencing.

Tifffile can also be used to inspect TIFF structures, read image data from multi-dimensional file sequences, write fsspec ReferenceFileSystem for TIFF files and image file sequences, patch TIFF tag values, and parse many proprietary metadata formats.

Changes

• Add methods to delete pages from main IFD chain and erase their content.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: experiments/mcp-genmedia/mcp-genmedia-go/mcp-chirp3-go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/sync	v0.22.0 -> v0.23.0

File name: experiments/mcp-genmedia/mcp-genmedia-go/mcp-lyria-go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
cloud.google.com/go/storage	v1.67.0 -> v1.67.1