Skip to content

build(deps): bump the python group across 1 directory with 5 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/python-7c00c539b2
Closed

build(deps): bump the python group across 1 directory with 5 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/python-7c00c539b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown

Bumps the python group with 5 updates in the /python directory:

Package From To
mcp 2.2.0 2.3.0
typer 0.27.2 0.27.3
hypothesis 6.168.0 6.168.5
ruff 0.16.7 0.16.10
ty 0.0.80 0.0.85

Updates mcp from 2.2.0 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

  • It used to send "experimental": {}. server/discover already left it out.
  • Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

  • MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
  • The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

  • The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
  • This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
  • A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

  • max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
  • MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
  • Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
  • Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

  • ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
  • An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
  • A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
  • Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
  • stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits
  • 2118f14 docs: refresh translations for recent English changes (#3636)
  • ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
  • d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
  • c15566c Link What's new to the Header parameters page (#3632)
  • 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
  • 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
  • c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
  • 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
  • cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
  • 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates hypothesis from 6.168.0 to 6.168.5

Commits
  • ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
  • c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
  • d862501 Bump hypothesis version to 6.168.4 and update changelog
  • de4ec1c Merge pull request #4887 from HypothesisWorks/create-pull-request/patch
  • 8a80889 add pypy312 support
  • 9ee265d Update pinned dependencies
  • f92f61c Fix the return type of django's from_field
  • 44b82b2 Bump hypothesis version to 6.168.3 and update changelog
  • aeaafb5 Merge pull request #4888 from gpacix/fix-quadratic-statistics
  • f3f4a29 wording, remove hardcoded test
  • Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

0.16.9

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits
  • 3265ed1 Bump version to 0.16.10 (#29055)
  • e786964 Authorize shared PR security-review workflow to publish findings (#29052)
  • a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
  • b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
  • 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
  • 317e0a3 [ty] Bound nested callable signature display (#29049)
  • 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
  • 56180bc [ty] Specialize instance members once (#29043)
  • aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
  • 2d25346 [ty] Improve unresolved-import documentation (#29039)
  • Additional commits viewable in compare view

Updates ty from 0.0.80 to 0.0.85

Release notes

Sourced from ty's releases.

0.0.85

Release Notes

Released on 2026-10-06.

Preview features

  • Refresh uv project metadata when uv files change (#28529)

Bug fixes

  • Avoid recursive lambda class decorator panics (#28984)
  • Compare observable notebook state for equality (#28874)
  • Detect recursive alias cycles through intersections (#28916)
  • Fix anchoring of include and exclude patterns after the project's root changed (#28995)
  • Fix stack overflow when inferring dynamic class metaclasses (#28917)
  • Normalize recursive dataclass transform metadata (#28920)
  • Normalize recursive TypedDicts during cycle recovery (#28918)
  • Preserve cycle markers in ParamSpec specialization (#29024)

CLI

  • Prefer existing @ paths over response files in Ruff and ty (#28877)

LSP server

  • Add namespace package support to import completions. (#28202)
  • Avoid stale I/O diagnostics when closing deleted files (#28988)
  • Contain rendered code within Markdown fences (#28869)
  • Refresh Python settings when virtual environments change (#28650)

Diagnostic improvements

  • Add opt-in truthiness-test-of-none-union rule (#28889)
  • Avoid disjoint-cast diagnostics in situations where the value could have been inferred as being compatible with the casted type if it had only been inferred with the right type context (#28851)
  • Bound nested callable signature display (#29049)
  • Explain outdated uv versions in metadata errors (#28959)
  • Improve display of string literal types that include unicode characters or double quotes (#29089)
  • Improve uv metadata diagnostics (#28990)
  • Preserve constrained type-variable failure diagnostics (#28768)
  • Preserve generic inference errors during diagnostic recovery (#28811)
  • Report deprecated overloads in decorator applications (#28999)

Core type checking

  • Bound methods without a receiver are not callable (#28981)
  • Fix member lookup on union-bounded type variables (#29018)
  • Fix type variable inference for final class objects (#29097)
  • Freshen ParamSpec identities consistently (#28826)
  • Honor generic property setters in protocol compatibility (#28562)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.85

Released on 2026-10-06.

Preview features

  • Refresh uv project metadata when uv files change (#28529)

Bug fixes

  • Avoid recursive lambda class decorator panics (#28984)
  • Compare observable notebook state for equality (#28874)
  • Detect recursive alias cycles through intersections (#28916)
  • Fix anchoring of include and exclude patterns after the project's root changed (#28995)
  • Fix stack overflow when inferring dynamic class metaclasses (#28917)
  • Normalize recursive dataclass transform metadata (#28920)
  • Normalize recursive TypedDicts during cycle recovery (#28918)
  • Preserve cycle markers in ParamSpec specialization (#29024)

CLI

  • Prefer existing @ paths over response files in Ruff and ty (#28877)

LSP server

  • Add namespace package support to import completions. (#28202)
  • Avoid stale I/O diagnostics when closing deleted files (#28988)
  • Contain rendered code within Markdown fences (#28869)
  • Refresh Python settings when virtual environments change (#28650)

Diagnostic improvements

  • Add opt-in truthiness-test-of-none-union rule (#28889)
  • Avoid disjoint-cast diagnostics in situations where the value could have been inferred as being compatible with the casted type if it had only been inferred with the right type context (#28851)
  • Bound nested callable signature display (#29049)
  • Explain outdated uv versions in metadata errors (#28959)
  • Improve display of string literal types that include unicode characters or double quotes (#29089)
  • Improve uv metadata diagnostics (#28990)
  • Preserve constrained type-variable failure diagnostics (#28768)
  • Preserve generic inference errors during diagnostic recovery (#28811)
  • Report deprecated overloads in decorator applications (#28999)

Core type checking

  • Bound methods without a receiver are not callable (#28981)
  • Fix member lookup on union-bounded type variables (#29018)
  • Fix type variable inference for final class objects (#29097)
  • Freshen ParamSpec identities consistently (#28826)
  • Honor generic property setters in protocol compatibility (#28562)
  • Infer nominal generic specializations from bounded type variables (#28812)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the python group across 1 directory with 5 updates
0fac17a 
Bumps the python group with 5 updates in the /python directory:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `2.2.0` | `2.3.0` |
| [typer](https://github.com/fastapi/typer) | `0.27.2` | `0.27.3` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.168.0` | `6.168.5` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.7` | `0.16.10` |
| [ty](https://github.com/astral-sh/ty) | `0.0.80` | `0.0.85` |



Updates `mcp` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.2.0...v2.3.0)

Updates `typer` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `hypothesis` from 6.168.0 to 6.168.5
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.0...v6.168.5)

Updates `ruff` from 0.16.7 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.16.10/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.10)

Updates `ty` from 0.0.80 to 0.0.85
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.80...0.0.85)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ty
  dependency-version: 0.0.85
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 12, 2026
@fmind

fmind commented Oct 13, 2026

Copy link
Copy Markdown
Owner

Superseded by c0bc19c on main (dependency gates repaired and grouped updates applied).

@fmind fmind closed this Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/uv/python/python-7c00c539b2 branch October 13, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fmind