Skip to content

chore(deps): bump the python group across 1 directory with 23 updates - #262

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-f6c0c09200
Closed

chore(deps): bump the python group across 1 directory with 23 updates#262
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-f6c0c09200

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 23 updates in the / directory:

Package From To
fastapi 0.141.1 0.159.1
python-dotenv 1.2.3 1.2.4
opentelemetry-proto 1.42.1 1.44.0
googleapis-common-protos 1.72.0 1.75.5
aiohttp 3.14.3 3.14.5
authlib 1.8.0 1.9.1
nltk 3.10.3 3.10.4
opentelemetry-sdk 1.42.1 1.44.0
opentelemetry-exporter-otlp-proto-http 1.42.1 1.44.0
opentelemetry-exporter-otlp-proto-grpc 1.42.1 1.44.0
grpcio 1.78.0 1.84.0
protobuf 6.33.5 7.36.2
grpcio-health-checking 1.78.0 1.84.0
grpcio-reflection 1.78.0 1.84.0
grpcio-status 1.78.0 1.84.0
opentelemetry-instrumentation-grpc 0.63b1 0.65b0
pydantic-settings 2.15.0 2.16.1
asyncpg 0.31.0 0.32.0
kubernetes 36.0.3 37.0.1
ruff 0.16.9 0.17.1
langchain 1.4.3 1.4.6
langchain-openai 1.6.7 1.7.2
pydantic 2.13.5 2.14.1

Updates fastapi from 0.141.1 to 0.159.1

Release notes

Sourced from fastapi's releases.

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

Fixes

0.158.0

Features

0.157.0

Features

  • ✨ Add support for combining query, header, and cookie parameter models. PR #16573 by @​tiangolo.

Docs

Internal

0.156.8

Fixes

  • 🐛 Preserve uploaded file positions when converting to bytes. PR #16566 by @​tiangolo.

0.156.7

Fixes

  • 🐛 Fix validation error locations for form and file AliasChoices. PR #16564 by @​tiangolo.

0.156.6

... (truncated)

Commits

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • See full diff in compare view

Updates opentelemetry-proto from 1.42.1 to 1.44.0

Release notes

Sourced from opentelemetry-proto's releases.

Version 1.44.0/0.65b0

Added

  • opentelemetry-docker-tests: Refactor Docker tests to properly validate contents of exported telemetry (#5220)
  • opentelemetry-exporter-otlp-common: add shared package for common OTLP utilities (#5252)
  • opentelemetry-sdk: add MissingDependencyError exception for declarative configuration and use it for missing optional dependency errors (#5265)
  • opentelemetry-sdk: Add ability to refresh process dependent Resource attributes (#5280)
  • opentelemetry-sdk: add force_flush method to LogRecordExporter ABC (#5294)
  • opentelemetry-sdk: Make it possible to limit the size of stored spans in InMemorySpanExporter (#5296)
  • opentelemetry-sdk: add log record limits environment variables OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT and OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT (#5300)
  • opentelemetry-sdk: add support for file exporter with declarative config (#5311)
  • opentelemetry-sdk: expose SynchronousMultiLogRecordProcessor and ConcurrentMultiLogRecordProcessor publicly (#5327)
  • opentelemetry-sdk: point the declarative configuration package README at the shared language support status matrix in the opentelemetry-configuration repo, so Python conformance status lives alongside the other languages instead of being duplicated per language SDK. (#5347)
  • opentelemetry-sdk: document that Python-implementation extensions (OTEL_PYTHON_* variables) are bypassed when OTEL_CONFIG_FILE is set. The env-var initialisation path is skipped entirely in favour of the declarative file; honouring these alongside a config file is tracked as a follow-up. (#5353)
  • opentelemetry-sdk: wire id_generator from declarative configuration to TracerProvider (#5363)
  • opentelemetry-sdk: Add support for activating instrumentors from a declarative configuration file via the instrumentation/development.python section. Instrumentors can declare a configuration attribute to have their options validated through the same type-coercion pipeline used for SDK component configuration. (#5372)
  • opentelemetry-sdk: add record_min_max option to ExponentialBucketHistogramAggregation, matching the option already available on ExplicitBucketHistogramAggregation and required by the specification (#5377)

Changed

  • opentelemetry-sdk: revert BoundedAttributes RLock back to Lock (#5329)
  • docs: update logs example to use opentelemetry-instrumentation-logging (#5344)
  • opentelemetry-sdk: bump declarative configuration schema to v1.1.0 (#5345)
  • opentelemetry-configuration: declarative configuration moves from opentelemetry.sdk._configuration into the new public opentelemetry-configuration package (opentelemetry.configuration namespace), published experimentally. opentelemetry-sdk[file-configuration] continues to work as an alias that installs opentelemetry-configuration alongside the SDK. (#5356)
  • opentelemetry-api: remove env carrier environment snapshot caching, you now have to pass explicitly the mapping where to get the environment variables from as the EnvironmentGetter.get first argument. (#5366)
  • opentelemetry-semantic-conventions: bump to 1.42.0 (#5410)
  • opentelemetry-semantic-conventions: bump to 1.43.0 (#5413)

Removed

  • opentelemetry-api, opentelemetry-sdk: Removed deprecated Events API/SDK. Use LogRecord with the event_name field set instead. (#5293)

Fixed

  • opentelemetry-sdk: Optimize LogRecord memory in BatchLogRecordProcessor by clearing the Context object before buffering. This is a potentially breaking change for custom log exporters that access context from the exported ReadableLogRecord, as the context will now be an empty Context() instead of the original. (#4977)
  • opentelemetry-sdk: drop non-finite measurements (NaN and Inf) at the instrument level to prevent permanent aggregation poisoning (#5336)
  • opentelemetry-sdk: raise ValueError when ExplicitBucketHistogramAggregation boundaries are not strictly increasing or finite (#5340)
  • opentelemetry-sdk: ProcessResourceDetector no longer collects or emits process.command_args and process.command_line by default since the values are not sanitized and may contain sensitive information. Users who depend on these resource attributes must pass include_command_args=True. (#5364)
  • opentelemetry-exporter-otlp-proto-http: fix the OTLP HTTP metric exporter self-observability metrics over-counting data points when max_export_batch_size splits a batch; each split now reports its own data-point count instead of the whole-batch count. (#5370)
  • opentelemetry-api: Prevent in-place mutation of Context via inherited dict methods (#5399)

Version 1.43.0/0.64b0

Added

  • opentelemetry-sdk: add add_metric_reader / remove_metric_reader public APIs to register / unregister metric readers at runtime. (#4863)
  • opentelemetry-exporter-prometheus: add support for configuring metric scope labels (#5123)
  • opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log message that's written when the grpc call fails. (#5143)
  • opentelemetry-exporter-http-transport: add 'opentelemetry-exporter-http-transport' package for HTTP exporters (#5194)
  • opentelemetry-sdk: Add composite/development samplers support to declarative file configuration (#5201)
  • opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter implementation (#5207)

... (truncated)

Changelog

Sourced from opentelemetry-proto's changelog.

Version 1.44.0/0.65b0 (2026-07-16)

Added

  • opentelemetry-docker-tests: Refactor Docker tests to properly validate contents of exported telemetry (#5220)
  • opentelemetry-exporter-otlp-common: add shared package for common OTLP utilities (#5252)
  • opentelemetry-sdk: add MissingDependencyError exception for declarative configuration and use it for missing optional dependency errors (#5265)
  • opentelemetry-sdk: Add ability to refresh process dependent Resource attributes (#5280)
  • opentelemetry-sdk: add force_flush method to LogRecordExporter ABC (#5294)
  • opentelemetry-sdk: Make it possible to limit the size of stored spans in InMemorySpanExporter (#5296)
  • opentelemetry-sdk: add log record limits environment variables OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT and OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT (#5300)
  • opentelemetry-sdk: add support for file exporter with declarative config (#5311)
  • opentelemetry-sdk: expose SynchronousMultiLogRecordProcessor and ConcurrentMultiLogRecordProcessor publicly (#5327)
  • opentelemetry-sdk: point the declarative configuration package README at the shared language support status matrix in the opentelemetry-configuration repo, so Python conformance status lives alongside the other languages instead of being duplicated per language SDK. (#5347)
  • opentelemetry-sdk: document that Python-implementation extensions (OTEL_PYTHON_* variables) are bypassed when OTEL_CONFIG_FILE is set. The env-var initialisation path is skipped entirely in favour of the declarative file; honouring these alongside a config file is tracked as a follow-up. (#5353)
  • opentelemetry-sdk: wire id_generator from declarative configuration to TracerProvider (#5363)
  • opentelemetry-sdk: Add support for activating instrumentors from a declarative configuration file via the instrumentation/development.python section. Instrumentors can declare a configuration attribute to have their options validated through the same type-coercion pipeline used for SDK component configuration. (#5372)

... (truncated)

Commits
  • 53a5a40 Prepare release 1.44.0/0.65b0 (#5422)
  • d9f34e7 Fixup eachdist.py handling of package names (#5417)
  • d10f472 opentelemetry-semantic-conventions: Bump to 1.43.0 (#5413)
  • ae8feeb Update otelbot token workflows to use client IDs (#5404)
  • 67a2abd Fix Context in-place mutability bypass via inherited dict methods (#5399)
  • 87baad9 Bump semconv to 1.42.0 (#5410)
  • 23dc0b2 opentelemetry-sdk: add 'force_flush' method to LogRecordExporter ABC (#5294)
  • bec55fd opentelemetry-sdk: expose SynchronousMultiLogRecordProcessor and ConcurrentMu...
  • 55d0b7a opentelemetry-sdk: Add ability to refresh process sensitive Resource attribut...
  • 6115db2 opentelemetry-sdk: add log record limits environment variables (#5300)
  • Additional commits viewable in compare view

Updates googleapis-common-protos from 1.72.0 to 1.75.5

Commits
  • d6bed5a chore: release main (#18464)
  • 78ff458 feat(gapic-generator): add schema support for resumable uploads (#18480)
  • af2100a tests: add showcase to golden files (#18479)
  • e1d306a fix: resolve error where google/longrunning/operations.proto is missing (#18477)
  • 7871fa9 fix(gapic-generator): init mock response in version header test (#18488)
  • 0b488a3 feat(bigtable): Reroute Mutations Batcher to use data client (#18200)
  • 30b4f44 fix(google-auth-oauthlib): prevent ipv6 address reuse (#18463)
  • 1d9f468 chore(main): release google-auth 2.59.0 (#18465)
  • c7c133a chore(bigtable): Added an internal batch completed callback to the data clien...
  • 8cb3c6a perf(spanner): optimize query option merging and prevent in-place mutation (#...
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates authlib from 1.8.0 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates nltk from 3.10.3 to 3.10.4

Release notes

Sourced from nltk's releases.

v3.10.4

Version 3.10.4 2026-10-20

This release routes every file path, archive, download, URL fetch and external program through one sandbox that keeps reads and writes inside the trusted data directories, refuses path traversal, symlink escapes and decompression bombs, blocks requests to internal network addresses, and runs Java and other third-party tools only from trusted absolute locations with validated options and input. Pickled models now load through a restricted unpickler, XML and JSON parsing are hardened, and regular expressions, recursion and slow algorithms in the tokenizers, parsers, stemmers and corpus readers are bounded against denial-of-service input. Text that NLTK writes to the terminal, to CSV files, to the WordNet browser and to third-party tool input is sanitized against injection.

Security changes you may notice

Every refusal below raises with a message that starts with "Security Violation" and names the check, so a failure is easy to search for (PR #3877).

  • Data directories (nltk.pathsec, nltk.data): corpora, models and every other resource are read and written only inside the directories listed in nltk.data.path. A path that leaves a data root, a symlink that points out of one, and a NUL byte or encoded traversal in a resource name are refused. A data root, or a directory on the way to a resource, that another account can write to is skipped with a warning naming the directory and the remedy. Keep private data in a private directory and add it to nltk.data.path; /tmp is not a data root. Model save and load methods (perceptron, maxent, named-entity chunker, Weka, crf, hunpos, Stanford) accept destinations inside a data root only (PR #3797, #3753, #3850, #3761, #3755, #3759, #3760, #3763, #3806, #3807, #3808, #3809, #3813, #3814, #3815, #3848, #3851, #3852, #3853, #3863, #3871, #3888, #3945, #3961, #3969, #3981)
  • Downloader: downloaded package archives stay private to the installing account (0600). An install another account must read is extracted: a download made as root or outside the installing account's home extracts on its own, and nltk.download(..., extract=True) / python -m nltk.downloader --extract (or --no-extract) decide explicitly. This also unpacks the packages the index leaves zipped (wordnet, omw-1.4 ...); the extracted files are readable by every account and are found before the archive. find() names an archive it cannot read and says how to extract it instead of reporting it "not found". The downloader installs only into directories no other account can write to, treats an archive another account owns or can write to as stale and downloads it afresh, extracts only from an archive no other account could have changed since its checksum was verified, bounds the size of what it fetches, and refuses index entries and archive members that would write outside the package directory (PR #3929, #3804, #3850, #3778)
  • Pickles: nltk.data.load(..., format="pickle") reconstructs plain data only; a pickle that names any class or function is refused. Model loaders that need classes use an explicit allowlist of audited globals, so a gadget such as os.system can never be reconstructed from a model file. chat80 shelve values load the same way (PR #3794, #3754, #3757, #3802, #3817, #3823, #3824)
  • XML, JSON and YAML: nltk.xmlsec refuses any document that declares an entity or references an external one (billion-laughs, external-entity and DTD attacks) and bounds the tree depth, and every corpus XML view, the downloader index, Toolbox and internals parse through it. JSON resources load with a depth and size bound; YAML (the markdown corpus front matter and nltk.data.load(..., format="yaml")) loads through a bounded safe loader. Oversized or too deeply nested input raises ValueError naming the limit (PR #3754, #3805, #3828, #3933, #3972, #3974)
  • Regular expressions (nltk.redos): every regular expression NLTK compiles, including one you pass to RegexpTokenizer, RegexpStemmer, RegexpParser, re_show, TokenSearcher.findall, tgrep, nltk.help tag-set lookups and the concordance and nemo GUIs, now goes through nltk.redos on the regex engine. A pattern longer than 100,000 characters, nested more than 100 deep, with more than 1,000 capturing groups or an excessive repetition product is refused with nltk.redos.error, a subclass of re.error; a match that runs longer than nltk.redos.DEFAULT_TIMEOUT (5 seconds) raises TimeoutError instead of hanging. Patterns keep re syntax; match objects are the regex engine's (PR #3825, #3829, #3830, #3831, #3832, #3833, #3834, #3835, #3836, #3837, #3838, #3839, #3840, #3841, #3842, #3843, #3844, #3845, #3846, #3796, #3801, #3906, #3907, #3908, #3910)
  • Regular expressions made linear: the leading-run and re-anchoring patterns that a timeout cannot catch were rewritten or bounded in the word, Treebank, blankline, TextTiling, toktok and syllable tokenizers, the readline of corpus streams, the CoNLL SRL, TIMIT, senseval, pl196x, NKJP, Alpino, YCOE, IEER, ACE, VerbNet, reviews and Lin readers, relextract, the valuation parser, the CCG lexicon parser, dependency grammars and chomsky_normal_form, each verified on the real corpus (PR #3947, #3934, #3932, #3938, #3935, #3933, #3869, #3944, #3911, #3909, #3953, #3895)
  • Size, depth and time bounds: trees deeper than nltk.tree.MAX_TREE_DEPTH (500), WordNet and other relation walks deeper than nltk.util.MAX_RECURSION_DEPTH (500), tgrep deeper than 50, Toolbox deeper than 500, dependency graphs deeper than 200, are refused with ValueError naming the limit rather than exhausting the stack, and the stemmers, distance metrics, skipgrams, parsers and grammar transforms run in linear or bounded time with identical output for legitimate input. chart_parse stops after nltk.parse.chart.DEFAULT_MAX_TIME (5 seconds of wall-clock, needed only for feature grammars; max_time=None disables it). Tree.repr no longer recurses, so a deep accepted tree prints (PR #3827, #3885, #3895, #3767, #3784, #3917, #3958, #3960, #3977)
  • External tools and Java: a tool binary is resolved from an absolute path or a trusted search path only, never from the current directory; the binary, its directory and the model and data files handed to it must not be writable by another account (symlinked and multi-call executables such as a packaged Graphviz dot are supported). java() accepts a main class as the first argument only (no -jar, @​argfile or .java source file), validates its options against an allowlist, and loads jars only from a data root unless NLTK_ALLOW_UNSAFE_JARS=1 opts out with a warning. CoreNLP server options are allowlisted. Stanford, Malt, Senna, hunpos, Prover9, megam, TADM, Weka and crf wrappers validate their paths and the text they pipe to the tool against line and argument injection (PR #3772, #3771, #3975, #3743, #3782, #3788, #3768, #3798, #3887, #3858, #3950, #3951, #3812, #3816, #3868, #3894, #3941, #3850, #3925)
  • Network: the downloader, nltk.data.load of a URL and the CHILDES reader fetch through pathsec.urlopen, which refuses addresses that are not globally routable (loopback, private, link-local and multicast, including tunnelled and obfuscated forms), pins the validated address for the connection, allows file:// with a local authority only, and refuses a proxied fetch unless NLTK_ALLOW_PROXIED_URLOPEN=1 (or nltk.pathsec.ALLOW_PROXIED_FETCH = True) asserts the proxy is trusted. The CoreNLP client talks to its local server with requests and is not affected (PR #3847, #3810, #3750, #3850)
  • Terminal, CSV, DOT and HTML output: every print in the library goes through nltk.termsec.safe_print, which renders control characters, escape sequences and unbalanced bidi overrides from corpus text as visible \xNN escapes instead of letting them reach the terminal. The CSV files the twitter and sentiment helpers write neutralise formula-leading and control-sequence cells, AlignedSent DOT labels are escaped, the WordNet browser escapes corpus text, and nltk.data.load's verbose output no longer prints the full resource URL (PR #3914, #3915, #3937, #3946, #3931, #3930, #3856, #3902)
  • Corpus stores and encodings: the PanLex Lite and chat80 sqlite stores open read-only on a pinned descriptor with their schema screened and a statement step budget, chat80 shelves are read by a key manifest, Toolbox SFM markers are sanitised, and a resource encoding that is not a text codec (bz2_codec and friends) is refused (PR #3961, #3964, #3959, #3888, #3800, #3962)
  • Package contents: the wheel no longer ships nltk.test.unit (the attack harnesses, advisory probes and their fixtures), so pip install nltk is about half the size and import nltk.test.unit works from a source checkout or the sdist only. The doctests under nltk.test still ship (PR #3954)

Security test and CI infrastructure

Other changes

  • Added RTL language syntactic tree visualization support (PR #3472)
  • Fix #3394: Ensure punkt_tab is downloaded when punkt is requested (PR #3505)
  • Show README.md as the PyPI long description (PR #3746)
  • Add stopwords.words("english-extended") (PR #3747)
  • Krippendorff's alpha: treat placeholder labels as missing data (#2865, #2732) (PR #3752)
  • Fix shared defaults in chat80 Concept (PR #3773)
  • Fix Java wrappers decoding str output from java() (universal_newlines) (PR #3777)
  • Prevent IndexError in Hungarian stemmer on empty string (PR #3785)
  • Isolate MTE tag filters per view (PR #3792)
  • Fix newline in ellipsis tokens in TweetTokenizer (PR #3819)
  • Isolate default WordNet reference relations (PR #3872)
  • Fix resolution paths that cancel distinct literals (PR #3878)
  • Fix UTF-8 text preprocessing in NKJP corpus reader (PR #3879)
  • Remove shadowed FeatStruct._walk stub and preserve its docstring (PR #3893)
  • Count all increasing pairs in RIBES kendall_tau (PR #3900)
  • Fix the TweetTokenizer ZWJ emoji pattern capturing adjacent whitespace (PR #3913)
  • Surface the CoreNLP server's reason for a non-2xx answer (PR #3942)
  • Omit unaligned (NULL target) pairs from Alignment strings, so IBM model output prints (PR #3967)
  • Fix DependencyGraph cycle detection, which returned False on every parsed graph (PR #3978)
  • Show, range and draw an alignment with an unaligned pair on every surface (PR #3987)

Thanks to the following contributors to 3.10.4: Zhewen Tan, Yanhaoxi, Yazan Balawneh (Cystack.ps),

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.4 2026-10-20

This release routes every file path, archive, download, URL fetch and external program through one sandbox that keeps reads and writes inside the trusted data directories, refuses path traversal, symlink escapes and decompression bombs, blocks requests to internal network addresses, and runs Java and other third-party tools only from trusted absolute locations with validated options and input. Pickled models now load through a restricted unpickler, XML and JSON parsing are hardened, and regular expressions, recursion and slow algorithms in the tokenizers, parsers, stemmers and corpus readers are bounded against denial-of-service input. Text that NLTK writes to the terminal, to CSV files, to the WordNet browser and to third-party tool input is sanitized against injection.

Security changes you may notice

Every refusal below raises with a message that starts with "Security Violation" and names the check, so a failure is easy to search for (PR #3877).

  • Data directories (nltk.pathsec, nltk.data): corpora, models and every other resource are read and written only inside the directories listed in nltk.data.path. A path that leaves a data root, a symlink that points out of one, and a NUL byte or encoded traversal in a resource name are refused. A data root, or a directory on the way to a resource, that another account can write to is skipped with a warning naming the directory and the remedy. Keep private data in a private directory and add it to nltk.data.path; /tmp is not a data root. Model save and load methods (perceptron, maxent, named-entity chunker, Weka, crf, hunpos, Stanford) accept destinations inside a data root only (PR #3797, #3753, #3850, #3761, #3755, #3759,

@dependabot
chore(deps): bump the python group across 1 directory with 23 updates
a00909d 
---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.159.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: opentelemetry-proto
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: googleapis-common-protos
  dependency-version: 1.75.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: nltk
  dependency-version: 3.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: opentelemetry-exporter-otlp-proto-grpc
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: grpcio
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: grpcio-health-checking
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: grpcio-reflection
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: grpcio-status
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: opentelemetry-instrumentation-grpc
  dependency-version: 0.65b0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pydantic-settings
  dependency-version: 2.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: asyncpg
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: kubernetes
  dependency-version: 37.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: langchain
  dependency-version: 1.4.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: langchain-openai
  dependency-version: 1.7.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added CLI dependencies Dependency updates labels Oct 26, 2026
@krisztianfekete krisztianfekete mentioned this pull request Oct 30, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 30, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-f6c0c09200 branch October 30, 2026 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

CLI dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants