Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 18 updates - #5591

Merged
chernistry merged 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-9da3d1fb20
Sep 9, 2026
Merged

chore(deps): bump the python-minor-and-patch group across 1 directory with 18 updates#5591
chernistry merged 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-9da3d1fb20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 18 updates in the / directory:

Package From To
cryptography 50.0.0 50.0.1
click 8.4.2 8.5.0
websockets 17.0.1 17.1
hypothesis 6.165.10 6.167.1
ruff 0.16.4 0.16.5
import-linter 2.13 2.14
schemathesis 4.25.1 4.25.2
boto3-stubs 1.43.78 1.43.86
grpcio 1.83.0 1.83.1
grpcio-tools 1.83.0 1.83.1
grpcio-reflection 1.83.0 1.83.1
openai-agents 0.13.6 0.22.0
e2b-code-interpreter 2.9.1 2.9.2
modal 1.5.4 1.5.5
boto3 1.43.78 1.43.86
azure-storage-blob 12.30.0 12.30.1
slack-sdk 3.43.0 3.44.0
huggingface-hub 1.28.0 1.29.0

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits
  • 8b19813 Release version 8.5.0
  • 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
  • 131c86a Add FAQ entry about UnicodeEncodeError on Windows
  • e1fd594 Add support of pathlib.Path to edit (#3781)
  • a1d8785 Add support of pathlib.Path to edit
  • 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
  • a6256bf Forwards all user's parameters set in PAGER
  • 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
  • 9835b0f Resolve the pager command once, in _pager_contextmanager
  • f36d58b Refactor pager stream handling (#3767)
  • Additional commits viewable in compare view

Updates websockets from 17.0.1 to 17.1

Release notes

Sourced from websockets's releases.

17.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • e87ea9b Release version 17.1.
  • caf68ab Minor whitespace normalization.
  • f4c73b7 Accept pathlib.Path objects in path arguments.
  • b1e4a14 Clarify when the new asyncio implementation became the default.
  • c7cc7ed Move process_exception to the Sans-I/O layer.
  • 2543503 Support reconnecting in the threading implementation.
  • 1c8fb09 Follow redirects in the sync implementation.
  • 1f7f0e5 Deprecate calling connect() directly.
  • c06d5c5 Support overriding host/post in the sync client.
  • 885e69b Add tests for connecting without a context manager.
  • Additional commits viewable in compare view

Updates hypothesis from 6.165.10 to 6.167.1

Commits
  • a8dcd74 Bump hypothesis version to 6.167.1 and update changelog
  • c862b6f Merge pull request #4874 from Zac-HD/claude/cu-many-reject-span-discard-yhaidc
  • df39994 Merge pull request #4873 from HypothesisWorks/create-pull-request/patch
  • afe5b0b Bump hypothesis version to 6.167.0 and update changelog
  • 06bfa69 Merge pull request #4870 from Zac-HD/claude/status-reason-ideas-dum8wm
  • 1d0e155 Add return annotation to satisfy mypy's disallow_incomplete_defs
  • a0a7dfc Report the failing assume() when .map() gives up
  • d010799 Rename _filter_gave_ups test helper to _get_filter_gave_ups
  • ef98ff9 Fix the type of Bundle transformations
  • 8e36c8f Require passing data to SampledFromStrategy._transform
  • Additional commits viewable in compare view

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Updates import-linter from 2.13 to 2.14

Changelog

Sourced from import-linter's changelog.

2.14 (2026-08-28)

  • Add broken_contract_guidance option to contracts, for explaining how to fix them when they're broken.
  • Add TextField for multi-line text configuration values.
  • Show the count of ignored imports next to a contract's result.
  • Add --no-logo option to hide the logo in terminal output.
Commits

Updates schemathesis from 4.25.1 to 4.25.2

Release notes

Sourced from schemathesis's releases.

Release 4.25.2

🔧 Changed

  • NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

  • NDJSON report omitting each failure's title, severity and operation.
  • Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
  • Missing Allure entry in the Reports section of the CLI summary.
  • Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
  • Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
  • Coverage phase ignoring keywords beside $ref when generating values.
  • Coverage phase ignoring patternProperties entries matching a declared property name.
Changelog

Sourced from schemathesis's changelog.

4.25.2 - 2026-08-24

🔧 Changed

  • NDJSON report spells phase names and skip reasons as machine tokens (stateful, not_applicable).

🐛 Fixed

  • NDJSON report omitting each failure's title, severity and operation.
  • Credentials from --header, --auth, --proxy and the schema URL stored unsanitized in the recorded command.
  • Missing Allure entry in the Reports section of the CLI summary.
  • Coverage phase emitting a pattern-matching string as a multipleOf violation for union types.
  • Coverage phase emitting a value two oneOf branches admit when one keeps keywords beside $ref.
  • Coverage phase ignoring keywords beside $ref when generating values.
  • Coverage phase ignoring patternProperties entries matching a declared property name.
Commits
  • 510bf7b chore: Release 4.25.2
  • c88a80d fix: Coverage phase ignoring patternProperties entries matching a declared ...
  • 8b934ba chore: NDJSON report spells phase names and skip reasons as machine tokens
  • f63aeac fix: Coverage phase ignoring keywords beside $ref when generating values
  • bd986ac fix: Coverage phase emitting a value two oneOf branches admit when one keep...
  • 3e02e72 fix: Coverage phase emitting a pattern-matching string as a multipleOf vi...
  • d583dac fix: Missing Allure entry in the Reports section of the CLI summary
  • a4f7646 fix: Credentials from --header, --auth, --proxy and the schema URL stor...
  • 098b239 fix: NDJSON report omitting each failure's title, severity and operation
  • See full diff in compare view

Updates boto3-stubs from 1.43.78 to 1.43.86

Commits

Updates grpcio from 1.83.0 to 1.83.1

Release notes

Sourced from grpcio's releases.

Release v1.83.1

This is release gRPC Core 1.83.1 (garden).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Commits
  • aae2670 [Backport][v1.83.x] Fix legacy_channel.cc compile error with `std::optional<a...
  • b77ea36 [Backport][v1.83.x] Memory optimization (#43297)
  • 9dcd5aa [CI] Fix Python 3.15 Sanity (#43299)
  • ed8899e [Backport][v1.83.x] Fixing bug in GoAway and gRPC Message Compression (#43270)
  • 5f8d6df [Release] Bump version to 1.83.1 (on v1.83.x branch) (#43274)
  • 291e0be [Backport][v1.83.x][Python] Fix the StatusCode Enums to be int (#43252)
  • 05ceb5d [CI][Backport][v1.83.x][Python] Fix PSM Interop xds-v3 Python continuous fail...
  • dbc73b8 [Backport][v1.83.x][PHP]updated workflow to preserve github folder (#43243)
  • See full diff in compare view

Updates grpcio-tools from 1.83.0 to 1.83.1

Release notes

Sourced from grpcio-tools's releases.

Release v1.83.1

This is release gRPC Core 1.83.1 (garden).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Commits

Updates grpcio-reflection from 1.83.0 to 1.83.1

Updates openai-agents from 0.13.6 to 0.22.0

Release notes

Sourced from openai-agents's releases.

v0.22.0

Key Changes

Version 0.22.0 is a minor release because it adds substantial runtime hardening and tightens an existing provider configuration contract. Applications that combine an explicit openai_client with organization or project must move those values to the AsyncOpenAI client.

Highlights:

  • Redacts terminal function-tool output rejected by agent output guardrails from replayable and persisted SDK state.
  • Raises ModelBehaviorError for non-streaming Responses with terminal status failed or incomplete.
  • Rejects conflicting provider options when OpenAIProvider receives an explicit client.
  • Isolates usage accounting between independent RunState checkpoints while preserving nested-agent aggregation.
  • Expands agents registered through handoff(agent) in generated graphs.
  • Clarifies the existing shallow-copy behavior of Agent.clone() and RealtimeAgent.clone().

What's Changed

Documentation & Other Changes

New Contributors

Full Changelog: openai/openai-agents-python@v0.21.1...v0.22.0

v0.21.1

What's Changed

... (truncated)

Changelog

Sourced from openai-agents's changelog.

0.22.0

Version 0.22.0 tightens failure handling and data isolation for several existing APIs. Applications that construct OpenAIProvider with an explicit client and also pass organization or project to the provider must remove those duplicate arguments.

Highlights:

  • When an agent-level output guardrail blocks final output produced directly by a terminal function tool, the SDK retains a replay-valid call/output pair only when validated fields permit safe reconstruction. The original function_call_output payload is replaced with the fixed text "Output withheld by an output guardrail." in session history, RunState, and streamed result state, and payload-bearing current-response guardrail metadata is cleared or replaced. If the current response contains reasoning or another unsupported shape, the SDK discards the complete current-response suffix instead. Earlier accepted turns and guardrail results remain available. See Output guardrails.
  • Non-streaming OpenAI Responses calls now raise ModelBehaviorError when the returned response has terminal status failed or incomplete, matching the existing streamed terminal-event handling. This applies to OpenAIResponsesModel and the Responses path in AnyLLMModel. See Exceptions.
  • [OpenAIProvider][agents.models.openai_provider.OpenAIProvider] now also raises UserError when openai_client is combined with organization or project. The existing conflicts with api_key, base_url, and websocket_base_url are unchanged. Configure these values on the explicit AsyncOpenAI client instead. See API keys and clients.
  • Each RunResult.to_state() checkpoint now owns an independent usage snapshot. A resumed result starts with the checkpoint totals and adds its own model calls without mutating the source result or sibling checkpoints. Nested Agent.as_tool() resumes continue to aggregate post-resume usage into the active outer run. See Usage in RunState checkpoints.
  • Agent visualization now recursively expands the tools, MCP servers, and downstream handoffs of a target registered with handoff(agent), matching direct Agent entries in an agent's handoffs list. See Generating a graph.
  • The Agent.clone() and RealtimeAgent.clone() API guidance now states their existing shallow-copy behavior precisely: list attributes that are not overridden remain the same list objects. Pass a new list when the clone must own the container independently. See Cloning/copying agents.

0.21.0

Version 0.21.0 requires openai v3 and moves the Agents SDK's OpenAI HTTP integrations to HTTPX2. Applications that use the default OpenAI client do not need to change their client setup, but applications that customize the OpenAI HTTP layer may need to migrate transport-facing code.

Highlights:

  • The required OpenAI dependency is now openai>=3.0.0,<4. A clean core installation uses HTTPX2 and no longer installs legacy httpx as a direct dependency.
  • The default OpenAI provider, Voice provider, Responses WebSocket support, tracing exporter, and provider retry normalization now use HTTPX2. Their existing Agents SDK public configuration and runtime behavior remain unchanged.
  • Applications that pass http_client= to AsyncOpenAI should migrate custom clients, transports, authentication, event hooks, mock transports, timeout values, URLs, requests, responses, and transport exception handling from httpx to httpx2. Prefer the OpenAI Python SDK's DefaultAsyncHttpx2Client when the application needs the OpenAI client's defaults plus custom HTTP options. See Custom HTTP clients with openai v3.
  • The Agents SDK does not convert arbitrary legacy HTTPX objects to HTTPX2. The OpenAI Python SDK's temporary legacy-client compatibility path requires an explicit httpx installation and should be treated as a migration bridge.
  • Local MCP HTTP customization continues to follow the installed MCP package: MCP Python SDK v1 supplies and uses legacy httpx, while MCP Python SDK v2 uses httpx2. Ordinary MCP connections do not need application changes. See MCP Python SDK v1 and v2.
  • Public provider-neutral testing utilities now cover Agent model, Sandbox session, Realtime session, and Voice pipeline workflows without provider or process dependencies. See Testing for recipes and guidance on when to keep the real provider adapter or integration boundary.

0.20.0

Version 0.20.0 includes a potentially breaking MCP dependency migration for applications that customize local MCP HTTP transports. It also updates the SDK default model used when an agent or run does not explicitly select one.

Highlights:

  • The SDK default model is now gpt-5.6-luna instead of gpt-5.4-mini. The default reasoning.effort="none" and verbosity="low" settings are unchanged.
  • Explicit agent models, run-level model overrides, and the OPENAI_DEFAULT_MODEL environment variable continue to take precedence over the SDK default.
  • Realtime input transcription settings now recognize gpt-transcribe, gpt-live-transcribe, and gpt-realtime-whisper. For low-latency gpt-live-transcribe sessions, nested audio.input.transcription settings can supply prompt, keywords, and multiple expected languages. The OpenAI client version pinned by this SDK supports the delay latency/accuracy level only with gpt-realtime-whisper. Use gpt-transcribe over WebSocket for transcription after a committed audio turn or for detected-language output. Setting audio.input.turn_detection=None explicitly disables automatic turn detection. See Input transcription settings.
  • Local MCP connections created by the Agents SDK now support MCP Python SDK v2 while retaining v1 compatibility through mcp>=1.19.0,<3. The Agents SDK adapts ordinary stdio, SSE, and Streamable HTTP connections automatically. With MCP v2 installed, these connections use mcp.Client(mode="auto") to probe the newest supported protocol and fall back to the legacy initialize handshake for older servers. If dependency resolution selects MCP v2, applications that supply custom httpx.Auth objects or httpx.AsyncClient factories must migrate those values to httpx2, or pin mcp<2 to retain the v1 HTTP stack. MCPServerStreamableHttp's params["ignore_initialized_notification_failure"] = True option also remains v1-only. See MCP Python SDK v1 and v2 for migration details.
  • Sandbox mount validation now rejects unsafe credential placement before sandbox or mount-helper side effects. Trusted applications can acknowledge mount-scoped or broad credential exposure for an exact in-container mount path without changing the storage capability tables. These acknowledgements are runtime-only and serialized sandbox state never grants credential authority by itself. At protected mount boundaries, the SDK returns a fresh redacted exception. If the source exception is an exact recognized SDK sandbox error and its approved structured fields validate, the replacement preserves that subtype and the validated safe fields. A recognized MountConfigError can also retain an SDK-generated safe validation message. Otherwise, the SDK returns a fresh generic redacted error. Provider-controlled or otherwise unapproved messages, command data, notes, context, causes, and source traceback state are not retained. See Mounts and remote storage and Resume from session state.
  • Retry policies can inspect stable replay-safety facts and explicitly set RetryDecision(approve_unsafe_replay=True) for a non-streaming request that the provider marked unsafe. This approval does not bypass aborts, emitted streamed output, or separate local-side-effect vetoes such as Programmatic Tool Calling. See Runner-managed retries.
  • Resumable RunState objects can now stage durable user input with add_input() before the next model call. Staged input survives serialization, runs through input guardrails, and produces one durable SDK input occurrence across local sessions and server-managed conversations. An explicitly approved unsafe replay can still resend the input to the provider and repeat provider-side work. See Add input before resuming.
  • Runtime reliability fixes align streamed and non-streamed output-guardrail session persistence, preserve FunctionTool subclasses during copying and namespacing, and raise an explicit error for unsupported Chat Completions audio output instead of silently completing an empty stream. The OpenAIResponsesCompactionSession wrapper attempts and awaits pre-compaction history recovery before cancellation reaches the caller. A VoicePipeline consumer now receives transcription-session close failures after a clean run, while an earlier turn failure retains precedence over a later close failure. RunState round trips now preserve local shell output, acknowledged computer safety checks, default-valued tool output fields, and Pydantic model or dataclass outputs encountered while traversing dictionaries, lists, or tuples. MCP conversion preserves free-form object schemas and image output, and serializes other raw content blocks such as audio and resource blocks as valid JSON text. MCPServerManager serializes overlapping lifecycle operations and applies finite default timeouts to connection and cleanup. Model replay removes server-owned created_by metadata from output items before using them as input.

0.19.0

This minor release does not introduce a breaking change. The minor version bump reflects a significant new OpenAI Responses feature area: Programmatic Tool Calling.

Highlights:

  • Added [ProgrammaticToolCallingTool][agents.tool.ProgrammaticToolCallingTool], which lets supported OpenAI Responses models generate JavaScript to coordinate tools eligible for Programmatic Tool Calling. It supports per-tool allowed_callers, structured outputs from FunctionTool instances, and integration with Runner streaming, guardrails, approvals, sessions, and RunState. See Programmatic Tool Calling for setup and constraints.
  • Added the public agents.decorators module and @tool as a shorter alias for the existing @function_tool decorator, alongside the existing guardrail decorators. FunctionTool instances now also support async callable objects.
  • SDK configuration now consistently accepts either typed settings objects or dictionaries across agents, runs, models, sessions, sandboxes, and voice pipelines, with validation for unknown settings.

... (truncated)

Commits
  • 4df9ecf release: 0.22.0 (#4523)
  • fb8fa1b fix(core): isolate usage between RunState checkpoints (#4479)
  • 9432f7e fix(visualization): expand handoff() targets in agent graphs (#4517)
  • 0486792 fix(core/extensions): reject terminal failed/incomplete responses in non-stre...
  • 36dbc36 docs: add testing resources to llms indexes (#4509)
  • ed644fc fix(core): redact blocked tool outputs from replay state (#4507)
  • 2c55603 test: make stream event ordering deterministic
  • 21a1f9b fix: avoid Windows integration bootstrap crashes
  • 32e4526 ci: change windows ci configuration for stability
  • ebb746d fix: keep Codex verification for development sandboxed (#4508)
  • Additional commits viewable in compare view

Updates e2b-code-interpreter from 2.9.1 to 2.9.2

Commits
  • de2a57f [skip ci] Release new versions
  • 7da6f09 test: share one Cloudflare workerd vitest config across the JS SDKs (#1778)
  • 8e36fea test(desktop-js): run the Desktop suite under Bun, Deno and Cloudflare worker...
  • d4a7f41 chore(sdk): deprecate the sandbox git module (#1774)
  • 84cabc2 ci(code-interpreter-js): run the full suite under Bun, Deno and Cloudflare in...
  • f0facc5 Share JavaScript SDK configuration defaults (#1770)
  • e1532e9 Migrate Code Interpreter and Desktop SDKs into the monorepo (#1768)
  • b5694e6 chore: remove SDK example files and their package.json scripts (#1769)
  • d42686d [skip ci] Release new versions
  • 587c15f fix(cli): pass options after the command through to the remote command in san...
  • Additional commits viewable in compare view

Updates modal from 1.5.4 to 1.5.5

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@dependabot
dependabot Bot requested a review from chernistry as a code owner September 7, 2026 06:37
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@github-actions
github-actions Bot enabled auto-merge September 7, 2026 06:37
@github-actions github-actions Bot added size/xs and removed dependencies Pull requests that update a dependency file labels Sep 7, 2026
@dependabot dependabot Bot changed the title chore(deps): bump the python-minor-and-patch group with 18 updates chore(deps): bump the python-minor-and-patch group across 1 directory with 18 updates Sep 7, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-9da3d1fb20 branch from eb3c467 to 702371b Compare September 7, 2026 23:38
@github-actions github-actions Bot added the docs label Sep 7, 2026
@chernistry chernistry added the needs-committer-review Green, unblocked, and waiting for committer review. Oldest first. label Sep 9, 2026
@chernistry
chernistry disabled auto-merge September 9, 2026 17:50
@chernistry
chernistry enabled auto-merge September 9, 2026 18:11
@chernistry

chernistry commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
af3c0af 
… with 18 updates

Bumps the python-minor-and-patch group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [websockets](https://github.com/python-websockets/websockets) | `17.0.1` | `17.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.165.10` | `6.167.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.5` |
| [import-linter](https://github.com/seddonym/import-linter) | `2.13` | `2.14` |
| [schemathesis](https://github.com/schemathesis/schemathesis) | `4.25.1` | `4.25.2` |
| [boto3-stubs](https://github.com/youtype/mypy_boto3_builder) | `1.43.78` | `1.43.86` |
| [grpcio](https://github.com/grpc/grpc) | `1.83.0` | `1.83.1` |
| [grpcio-tools](https://github.com/grpc/grpc) | `1.83.0` | `1.83.1` |
| [grpcio-reflection](https://grpc.io) | `1.83.0` | `1.83.1` |
| [openai-agents](https://github.com/openai/openai-agents-python) | `0.13.6` | `0.22.0` |
| [e2b-code-interpreter](https://github.com/e2b-dev/e2b) | `2.9.1` | `2.9.2` |
| [modal](https://github.com/modal-labs/modal-client) | `1.5.4` | `1.5.5` |
| [boto3](https://github.com/boto/boto3) | `1.43.78` | `1.43.86` |
| [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python) | `12.30.0` | `12.30.1` |
| [slack-sdk](https://github.com/slackapi/python-slack-sdk) | `3.43.0` | `3.44.0` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.28.0` | `1.29.0` |



Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.2...8.5.0)

Updates `websockets` from 17.0.1 to 17.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.0.1...17.1)

Updates `hypothesis` from 6.165.10 to 6.167.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.165.10...v6.167.1)

Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `import-linter` from 2.13 to 2.14
- [Changelog](https://github.com/seddonym/import-linter/blob/main/docs/release_notes.md)
- [Commits](import-linter/import-linter@v2.13...v2.14)

Updates `schemathesis` from 4.25.1 to 4.25.2
- [Release notes](https://github.com/schemathesis/schemathesis/releases)
- [Changelog](https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md)
- [Commits](schemathesis/schemathesis@v4.25.1...v4.25.2)

Updates `boto3-stubs` from 1.43.78 to 1.43.86
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `grpcio` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.83.0...v1.83.1)

Updates `grpcio-tools` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.83.0...v1.83.1)

Updates `grpcio-reflection` from 1.83.0 to 1.83.1

Updates `openai-agents` from 0.13.6 to 0.22.0
- [Release notes](https://github.com/openai/openai-agents-python/releases)
- [Changelog](https://github.com/openai/openai-agents-python/blob/main/docs/release.md)
- [Commits](openai/openai-agents-python@v0.13.6...v0.22.0)

Updates `e2b-code-interpreter` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/e2b-dev/e2b/releases)
- [Commits](https://github.com/e2b-dev/e2b/compare/[email protected]...@e2b/[email protected])

Updates `modal` from 1.5.4 to 1.5.5
- [Changelog](https://github.com/modal-labs/modal-client/blob/main/CHANGELOG_DEV.md)
- [Commits](modal-labs/modal-client@py/v1.5.4...py/v1.5.5)

Updates `boto3` from 1.43.78 to 1.43.86
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.78...1.43.86)

Updates `azure-storage-blob` from 12.30.0 to 12.30.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.30.0...azure-storage-blob_12.30.1)

Updates `slack-sdk` from 3.43.0 to 3.44.0
- [Release notes](https://github.com/slackapi/python-slack-sdk/releases)
- [Commits](slackapi/python-slack-sdk@v3.43.0...v3.44.0)

Updates `huggingface-hub` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.28.0...v1.29.0)

---
updated-dependencies:
- dependency-name: azure-storage-blob
  dependency-version: 12.30.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: boto3-stubs
  dependency-version: 1.43.83
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: e2b-code-interpreter
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: grpcio
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: grpcio-reflection
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: grpcio-tools
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: huggingface-hub
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.167.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: import-linter
  dependency-version: '2.14'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: modal
  dependency-version: 1.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: openai-agents
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: schemathesis
  dependency-version: 4.25.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: slack-sdk
  dependency-version: 3.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: websockets
  dependency-version: '17.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-9da3d1fb20 branch from 702371b to af3c0af Compare September 9, 2026 18:34
@chernistry
chernistry added this pull request to the merge queue Sep 9, 2026
Merged via the queue into main with commit 939f36b Sep 9, 2026
56 of 57 checks passed
@chernistry
chernistry deleted the dependabot/uv/python-minor-and-patch-9da3d1fb20 branch September 9, 2026 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chernistry chernistry Awaiting requested review from chernistry chernistry is a code owner
@vaibhav8a vaibhav8a Awaiting requested review from vaibhav8a
@thegoodengineer thegoodengineer Awaiting requested review from thegoodengineer
@tenequm tenequm Awaiting requested review from tenequm
@Phoenix1504e Phoenix1504e Awaiting requested review from Phoenix1504e

Assignees

No one assigned

Labels

docs needs-committer-review Green, unblocked, and waiting for committer review. Oldest first. size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chernistry