Skip to content

chore(deps): Bump the dependencies group across 1 directory with 7 updates - #152

Merged
millsmillsymills merged 2 commits into
phase1from
dependabot/uv/dependencies-bb4a5d3759
Jul 28, 2026
Merged

chore(deps): Bump the dependencies group across 1 directory with 7 updates#152
millsmillsymills merged 2 commits into
phase1from
dependabot/uv/dependencies-bb4a5d3759

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 6 updates in the / directory:

Package From To
fastmcp 3.4.2 3.4.4
protobuf 6.33.5 7.35.1
pytest 9.1.0 9.1.1
hypothesis 6.155.3 6.158.0
ruff 0.15.17 0.15.22
ty 0.0.49 0.0.61

Updates fastmcp from 3.4.2 to 3.4.4

Release notes

Sourced from fastmcp's releases.

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

What's Changed

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.5: Key Change

FastMCP 3.4.5 collects five fixes for the 3.x line, led by JWTVerifier no longer rejecting every token when an authorization server publishes an unrecognized key type such as Ed25519.

Fixes 🐞

New Contributors

Full Changelog: v3.4.4...v3.4.5

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

... (truncated)

Commits
  • 9138d40 Docs: add v3.4.4 changelog entries (#4473)
  • d929882 Hugging Face Auth Integration (#4385)
  • 5fe4fae Restore HTTP host guard compatibility (#4472)
  • 400db61 Relax host origin guard defaults (#4439)
  • 1eedd1f Docs: add v3.4.2 and v3.4.3 changelog entries (#4430)
  • 3b1afe6 chore(deps): bump joserfc from 1.6.7 to 1.6.8 in the uv group across 1 direct...
  • 874425a chore: Update SDK documentation (#4427)
  • 691766b [codex] Fix OpenAPI resource template requests (#4407)
  • 47907e0 Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)
  • c1b0396 Block IPv6 transition SSRF bypasses (#4426)
  • Additional commits viewable in compare view

Updates protobuf from 6.33.5 to 7.35.1

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

... (truncated)

Commits

Updates pytest from 9.1.0 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.
Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates hypothesis from 6.155.3 to 6.158.0

Commits
  • 878d8d4 Bump hypothesis version to 6.158.0 and update changelog
  • a4a0189 Merge pull request #4805 from Zac-HD/claude/datetimes-tz-aware-bounds-wqraa0
  • 3ea81f9 add a few tests
  • 4ce090f Bump hypothesis version to 6.157.2 and update changelog
  • 068b2cf Merge pull request #4796 from HypothesisWorks/migrate-floats-to-rust
  • 434689a skip tests that hit half bugs, address review
  • 0884e3f Merge remote-tracking branch 'upstream/master' into plait/review-hypothesis-4796
  • b75fa2b Support timezone-aware bounds in datetimes()
  • 00e62be Bump hypothesis version to 6.157.1 and update changelog
  • 20ec468 Merge pull request #4804 from HypothesisWorks/claude/span-keyed-explain-comments
  • Additional commits viewable in compare view

Updates ruff from 0.15.17 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

Updates ty from 0.0.49 to 0.0.61

Release notes

Sourced from ty's releases.

0.0.61

Release Notes

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.61

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Commits

Updates grpcio-tools from 1.81.1 to 1.83.0

Release notes

Sourced from grpcio-tools's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
  • [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

  • Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
  • [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

  • [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
  • [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
  • [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
  • [Python] Pyright typeCheckingMode - standard. (#42739)
  • [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
  • [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
  • [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

... (truncated)

Commits
  • c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
  • 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
  • 1454079 [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 (#42914)
  • 6953d6a [Python] Remove 3.15 until Python 3.15 RC is released. (#42900)
  • b025e18 [Python] Support 3.15 (#42388)
  • b6a490e [Python][grpcio-tools] Fix build error when CXX contains spaces (#42742)
  • 8a56164 [Core] Upgrade to protobuf@35.1 to get upstream MSVC bug fix. (#42773)
  • 95f01e5 [Release] Bump version to 1.83.0-dev (on master branch) (#42638)
  • f72dd8c [Python] Trim Python2 backward compatibility syntax - remove "future" (#4...
  • 3618643 [Core] Upgrade to protobuf 35 (#42512)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 17, 2026
This was referenced Jul 17, 2026
Open
Merged
millsmillsymills added a commit that referenced this pull request Jul 28, 2026
@millsmillsymills @claude
fix(deps): bump mcp 1.28.1 + setuptools 83.0.0 (audit) (#154)
76b843d 
Clears the pip-audit findings (mcp CVE-2026-59950, setuptools PYSEC-2026-3447)
that fail the audit gate on main and block Dependabot #152.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@millsmillsymills

millsmillsymills commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
chore(deps): Bump the dependencies group across 1 directory with 7 up…
e28ef23 
…dates

Bumps the dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.2` | `3.4.4` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.5` | `7.35.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.0` | `9.1.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.155.3` | `6.158.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.17` | `0.15.22` |
| [ty](https://github.com/astral-sh/ty) | `0.0.49` | `0.0.61` |



Updates `fastmcp` from 3.4.2 to 3.4.4
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.2...v3.4.4)

Updates `protobuf` from 6.33.5 to 7.35.1
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pytest` from 9.1.0 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.0...9.1.1)

Updates `hypothesis` from 6.155.3 to 6.158.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.155.3...v6.158.0)

Updates `ruff` from 0.15.17 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.15.22/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.17...0.15.22)

Updates `ty` from 0.0.49 to 0.0.61
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.49...0.0.61)

Updates `grpcio-tools` from 1.81.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.81.1...v1.83.0)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 3.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: grpcio-tools
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hypothesis
  dependency-version: 6.156.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: protobuf
  dependency-version: 7.35.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.15.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ty
  dependency-version: 0.0.58
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/dependencies-bb4a5d3759 branch from 206b245 to e28ef23 Compare July 28, 2026 19:59
@millsmillsymills
millsmillsymills merged commit 3053282 into phase1 Jul 28, 2026
6 checks passed
@millsmillsymills
millsmillsymills deleted the dependabot/uv/dependencies-bb4a5d3759 branch July 28, 2026 20:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@millsmillsymills