Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth/server - #14367
Bump idna from 3.10 to 3.15 in /python/samples/demos/mcp_with_oauth/server#14367dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.10...v3.15) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 66c040680888
Model: claude-opus-4.8
Overview
This is a Dependabot bump of the transitive dependency idna from 3.10 to 3.15 that touches only the isolated sample lockfile python/samples/demos/mcp_with_oauth/server/uv.lock. The change is mechanically correct: uv lock --locked resolves cleanly, the pinned idna sdist/wheel sha256 hashes match PyPI exactly, requires-python = ">=3.10" is preserved, and the incidental re-resolution (revision 2->3, added resolution-markers, and Python-3.14+ forks of pydantic/pydantic-core/typing-inspection) is internally consistent with each branch mutually exclusive on python_full_version. The lockfile is not consumed by any CI job and the repo's primary python/uv.lock is already revision 3, so no new tooling floor is introduced. The bump is a net security improvement (idna >=3.14 remediates CVE-2026-45409). No Critical, High, or Medium defect was substantiated.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
|
Looks like idna is up-to-date now, so this is no longer needed. |
|
Superseded by #14385 |
### Motivation and Context Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies. ### Description Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest `main`. The incompatible MCP 2.x and Python 3.10 `onnxruntime-genai` updates are excluded, the private-feed-only `@humanfs/node` update is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency. ### Related Issue Supersedes: - microsoft#14177 - microsoft#14179 - microsoft#14180 - microsoft#14190 - microsoft#14209 - microsoft#14230 - microsoft#14233 - microsoft#14254 - microsoft#14257 - microsoft#14259 - microsoft#14260 - microsoft#14261 - microsoft#14271 - microsoft#14272 - microsoft#14273 - microsoft#14274 - microsoft#14276 - microsoft#14280 - microsoft#14282 - microsoft#14299 - microsoft#14300 - microsoft#14335 - microsoft#14337 - microsoft#14338 - microsoft#14339 - microsoft#14357 - microsoft#14358 - microsoft#14361 - microsoft#14365 - microsoft#14366 - microsoft#14367 - microsoft#14368 - microsoft#14369 ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rogerbarreto <19890735+rogerbarreto@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
Bumps idna from 3.10 to 3.15.
Changelog
Sourced from idna's changelog.
... (truncated)
Commits
af30a09Release 3.1530314d4Pre-release 3.15rc005d4b21Merge pull request #237 from kjd/convert-docs-to-markdown2987fdbConvert README and HISTORY from reStructuredText to Markdown59fa800Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333eadef6983Merge branch 'master' into dependabot/github_actions/actions-f3e34333eabbd8004Merge pull request #234 from StanFromIreland/patch-1edd07c0Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group5557db0Merge branch 'master' into patch-1f11746cMerge pull request #235 from StanFromIreland/patch-2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.