Skip to content

Bump the python-runtime group across 1 directory with 26 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-runtime-cffe286adf
Open

Bump the python-runtime group across 1 directory with 26 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-runtime-cffe286adf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Updates the requirements on alembic, cryptography, fastapi, psycopg, uvicorn, sqlmodel, pydantic-settings, pyjwt, openai, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-sdk, prometheus-client, pyyaml, build, httpx, nibabel, numpy, pydicom, pytest, pytest-cov, ruff, monai, opacus, scipy and pybids to permit the latest version.
Updates alembic to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

  • [usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

    References: #1712

  • [usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

    References: #1806

bug

  • [bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

    References: #1258

  • [bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

    References: #1745, #779

  • [bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

Updates cryptography to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12


* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table>

... (truncated)

Commits
  • e300bbe bump version and changelog for 49.0.0 (#15030)
  • fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
  • f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
  • 608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
  • a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
  • 33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
  • 6080dc7 Bump dependencies that dependabot isn't (#15026)
  • 121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
  • 829520b Add more robust processing for DH parameters. (#15016)
  • 0f05001 Bump downstream dependencies in CI (#15025)
  • Additional commits viewable in compare view

Updates fastapi to 0.140.0

Release notes

Sourced from fastapi's releases.

0.140.0

Refactors

Docs

Internal

Commits

Updates psycopg to 3.3.4

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.5 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
  • Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Current release

Psycopg 3.3.4 ^^^^^^^^^^^^^

  • Fix possible spurious connection timeout in systems with very long uptimes in C extension (:ticket:[#1280](https://github.com/psycopg/psycopg/issues/1280)).
  • Fix client-side adaptation of enums whose name require quotes (:ticket:[#1298](https://github.com/psycopg/psycopg/issues/1298)).
  • Consistently populate ~Cursor.statusmessage after ~Cursor.executemany() (:ticket:[#1302](https://github.com/psycopg/psycopg/issues/1302)).

Psycopg 3.3.3 ^^^^^^^^^^^^^

  • Retain Error.pgconn when raising a single exception for multiple connection attempt errors (:ticket:[#1246](https://github.com/psycopg/psycopg/issues/1246)).
  • Return a proper error when server sends ErrorResponse for a Sync after a Parse (:ticket:[#1260](https://github.com/psycopg/psycopg/issues/1260)).

Psycopg 3.3.2

... (truncated)

Commits
  • 83f1103 chore: bump psycopg_pool package version to 3.3.1
  • 1828770 chore: bump psycopg package version to 3.3.4
  • 8be14bb Merge pull request #1301 from oliverhaas/fix/sync-pool-open-race
  • aee0bf2 fix(pool): fix race in the construction of the sync ConnectionPool lock
  • bc4d303 chore(deps): bump the actions group across 1 directory with 4 updates
  • 785379f fix: retain statusmessage after executemany with returning=False
  • 8882a73 perf: do less if X in Y: return Y[X] for cache-like patterns
  • 2f78539 Merge pull request #1299 from dvarrazzo/fix-camel-enum
  • 37ef1dc test: skip test on crdb depending on precise regtype behaviour
  • 7f2f1d1 fix: fix client-side representation of enums requiring quotes
  • Additional commits viewable in compare view

Updates uvicorn to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

  • Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)
  • Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)
  • Default --ws auto to websockets-sansio when websockets is installed (#2985)
  • Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)
  • Build a fresh asgi scope dict per request (#2977)
  • Cache the asgi scope sub-dict per connection (#2976)
  • Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)
  • Memoize trusted host checks in ProxyHeadersMiddleware (#2970)
  • Replace click.style with an internal ANSI style helper (#2981)

Deprecated

  • Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

  • Bump httptools minimum version to 0.8.0 (#2962)
  • Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

... (truncated)

Commits
  • e4d0b05 Version 0.51.0 (#3028)
  • 944e43d Remove colorama from the standard extra (#3027)
  • 2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
  • a1b570c Version 0.50.2 (#3022)
  • 83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
  • b4d0116 Version 0.50.1 (#3020)
  • 2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
  • 1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
  • 837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
  • 21d2c16 Version 0.50.0 (#3013)
  • Additional commits viewable in compare view

Updates sqlmodel to 0.0.39

Changelog

Sourced from sqlmodel's changelog.

0.0.39 (2026-06-25)

Features

  • ✨ Add SQLModel Agent Library Skill, install with uvx library-skills. PR #2017 by @​tiangolo.

Fixes

Docs

Internal

... (truncated)

Commits

Updates pydantic-settings to 2.14.2

Release notes

Sourced from pydantic-settings's releases.

v2.14.2

What's Changed

This is a security patch release.

Security

Fixes GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource with secrets_nested_subdir=True could follow a symbolic link inside secrets_dir pointing outside it, reading out-of-tree files into settings values and bypassing the secrets_dir_max_size cap. Affected versions: >= 2.12.0, < 2.14.2.

Full Changelog: pydantic/pydantic-settings@v2.14.1...v2.14.2

Commits
  • d703bd7 Prepare release 2.14.2 (#890)
  • e95c30b Prepare release 2.14.1 (#859)
  • 0c87345 Fix field named cls conflicting with classmethod parameter (#858)
  • 7bd0072 Bump the python-packages group with 2 updates (#856)
  • b03e573 Bump the github-actions group with 3 updates (#853)
  • eaa3b43 Bump the python-packages group with 5 updates (#854)
  • 9f95615 Bump the python-packages group with 4 updates (#850)
  • 8916bee Prepare release 2.14.0 (#848)
  • 39e551c Fix CLI descriptions lost under python -OO by falling back to `json_schema_...
  • 9ed7f48 Bump the python-packages group with 4 updates (#847)
  • Additional commits viewable in compare view

Updates pyjwt to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

  • GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

  • GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

  • GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

  • GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

  • GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

  • Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
  • Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
  • RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

  • Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

  • Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
  • PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
  • PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
  • b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
  • enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt's changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security


- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.

Fixed



- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed




    

  • Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__
    • 



v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;__
</tr></table>

... (truncated)

Commits
  • 7144e45 Apply ruff format
  • d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
  • 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
  • 95791b1 Bundle security fixes and hardening into 2.13.0
  • dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
  • 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
  • b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
  • 40e3147 Migrate development extras to dependency groups (#1152)
  • a4e1a3d Add typing_extensions dependency for Python < 3.11 (#1151)
  • bd9700c Use PyJWK algorithm when encoding without explicit algorithm (#1148)
  • Additional commits viewable in compare view

Updates openai to 2.48.0

Release notes

Sourced from openai's releases.

v2.48.0

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (36820e6)
  • api: add support for spend_limit admin apis (1ff13af)
Changelog

Sourced from openai's changelog.

2.48.0 (2026-07-23)

Full Changelog: v2.47.0...v2.48.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (36820e6)
  • api: add support for spend_limit admin apis (1ff13af)

2.47.0 (2026-07-21)

Full Changelog: v2.46.0...v2.47.0

Features

  • client: Add experimental runtime support for HTTPX2 clients (#3524) (317260c)
  • stlc: configurable CI runner and private-production-repo support in workflow templates (4303e97)

Bug Fixes

  • deps: require patched aiohttp on Python 3.10+ (#3515) (d4dceb2)

2.46.0 (2026-07-17)

Full Changelog: v2.45.0...v2.46.0

Features

  • api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (5a00941)
  • api: add owner_project_access to APIKeyListParams (f589d04)
  • api: manual updates (980f176)
  • api: manual updates (2eae984)

Bug Fixes

  • api: preserve generated type compatibility (00bd72a)
  • api: remove beta annotation compatibility aliases (99dbd15)

2.45.0 (2026-07-09)

Full Changelog: v2.44.0...v2.45.0

Features

  • api: gpt-5.6-sol updates (039d1fe)

Bug Fixes

... (truncated)

Commits
  • 8a6adcb release: 2.48.0
  • cbd2fba feat(api): add support for spend_limit admin apis
  • 00709f2 feat(api): accept None for prompt_cache_key/safety_identifier
  • e67afa8 release: 2.47.0
  • e1925e9 feat(client): Add experimental runtime support for HTTPX2 clients (#3524)
  • 7f4edb6 feat(stlc): configurable CI runner and private-production-repo support in wor...
  • d4dceb2 fix(deps): require patched aiohttp on Python 3.10+ (#3515)
  • b140f45 ci: Set up CodeQL scanning (#3514)
  • 0e6adb1 release: 2.46.0 (#3501)
  • f16fbbd release: 2.45.0 (#3478)
  • Additional commits viewable in compare view

Updates opentelemetry-api to 1.44.0

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.44.0/0.65b0 (2026-07-16)

Added

  • opentelemetry-docker-tests: Refactor Docker tests to properly validate contents of exported telemetry (#5220)
  • opentelemetry-exporter-otlp-common: add shared package for common OTLP utilities (#5252)
  • opentelemetry-sdk: add MissingDependencyError exception for declarative configuration and use it for missing optional dependency errors (#5265)
  • opentelemetry-sdk: Add ability to refresh process dependent Resource attributes (#5280)
  • opentelemetry-sdk: add force_flush method to LogRecordExporter ABC (#5294)
  • opentelemetry-sdk: Make it possible to limit the size of stored spans in InMemorySpanExporter (#5296)
  • opentelemetry-sdk: add log record limits environment variables OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT and OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT (#5300)
  • opentelemetry-sdk: add support for file exporter with declarative config (#5311)
  • opentelemetry-sdk: expose SynchronousMultiLogRecordProcessor and ConcurrentMultiLogRecordProcessor publicly (#5327)
  • opentelemetry-sdk: point the declarative configuration package README at the shared language support status matrix in the opentelemetry-configuration repo, so Python conformance status lives alongside the other languages instead of being duplicated per language SDK. (#5347)
  • opentelemetry-sdk: document that Python-implementation extensions (OTEL_PYTHON_* variables) are bypassed when OTEL_CONFIG_FILE is set. The env-var initialisation path is skipped entirely in favour of the declarative file; honouring these alongside a config file is tracked as a follow-up. (#5353)
  • opentelemetry-sdk: wire id_generator from declarative configuration to TracerProvider (#5363)
    • <...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 26, 2026
@dependabot dependabot Bot changed the title Bump the python-runtime group with 26 updates Bump the python-runtime group across 1 directory with 26 updates Jul 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-runtime-cffe286adf branch from 50ff863 to 58373a8 Compare July 26, 2026 04:22
@dependabot
Bump the python-runtime group across 1 directory with 26 updates
d850566 
Updates the requirements on [alembic](https://github.com/sqlalchemy/alembic), [cryptography](https://github.com/pyca/cryptography), [fastapi](https://github.com/fastapi/fastapi), [psycopg](https://github.com/psycopg/psycopg), [uvicorn](https://github.com/Kludex/uvicorn), [sqlmodel](https://github.com/fastapi/sqlmodel), [pydantic-settings](https://github.com/pydantic/pydantic-settings), [pyjwt](https://github.com/jpadilla/pyjwt), [openai](https://github.com/openai/openai-python), [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python), [prometheus-client](https://github.com/prometheus/client_python), [pyyaml](https://github.com/yaml/pyyaml), [build](https://github.com/pypa/build), [httpx](https://github.com/encode/httpx), [nibabel](https://github.com/nipy/nibabel), [numpy](https://github.com/numpy/numpy), [pydicom](https://github.com/pydicom/pydicom), [pytest](https://github.com/pytest-dev/pytest), [pytest-cov](https://github.com/pytest-dev/pytest-cov), [ruff](https://github.com/astral-sh/ruff), [monai](https://github.com/Project-MONAI/MONAI), [opacus](https://github.com/pytorch/opacus), [scipy](https://github.com/scipy/scipy) and [pybids](https://github.com/bids-standard/pybids) to permit the latest version.

Updates `alembic` to 1.18.5
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `cryptography` to 49.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.0...49.0.0)

Updates `fastapi` to 0.140.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.115.0...0.140.0)

Updates `psycopg` to 3.3.4
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.2.0...3.3.4)

Updates `uvicorn` to 0.51.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.30.0...0.51.0)

Updates `sqlmodel` to 0.0.39
- [Release notes](https://github.com/fastapi/sqlmodel/releases)
- [Changelog](https://github.com/fastapi/sqlmodel/blob/main/docs/release-notes.md)
- [Commits](fastapi/sqlmodel@0.0.22...0.0.39)

Updates `pydantic-settings` to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.6.0...v2.14.2)

Updates `pyjwt` to 2.13.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.10.0...2.13.0)

Updates `openai` to 2.48.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v1.55.0...v2.48.0)

Updates `opentelemetry-api` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.29.0...v1.44.0)

Updates `opentelemetry-exporter-otlp-proto-http` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.29.0...v1.44.0)

Updates `opentelemetry-sdk` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.29.0...v1.44.0)

Updates `prometheus-client` to 0.26.0
- [Release notes](https://github.com/prometheus/client_python/releases)
- [Commits](prometheus/client_python@v0.21.0...v0.26.0)

Updates `pyyaml` to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0...6.0.3)

Updates `build` to 1.5.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.2.0...1.5.0)

Updates `httpx` to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.27.0...0.28.1)

Updates `nibabel` to 5.4.2
- [Release notes](https://github.com/nipy/nibabel/releases)
- [Changelog](https://github.com/nipy/nibabel/blob/master/Changelog)
- [Commits](nipy/nibabel@5.3.0...5.4.2)

Updates `numpy` to 2.4.6
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.0.0...v2.4.6)

Updates `pydicom` to 3.0.2
- [Release notes](https://github.com/pydicom/pydicom/releases)
- [Commits](pydicom/pydicom@v3.0.0...v3.0.2)

Updates `pytest` to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `pytest-cov` to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.0.0...v7.1.0)

Updates `ruff` to 0.16.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.8.0...0.16.0)

Updates `monai` to 1.6.0
- [Release notes](https://github.com/Project-MONAI/MONAI/releases)
- [Changelog](https://github.com/Project-MONAI/MONAI/blob/dev/CHANGELOG.md)
- [Commits](Project-MONAI/MONAI@1.4.0...1.6.0)

Updates `opacus` to 1.6.0
- [Release notes](https://github.com/pytorch/opacus/releases)
- [Changelog](https://github.com/meta-pytorch/opacus/blob/main/CHANGELOG.md)
- [Commits](meta-pytorch/opacus@v1.5...v1.6.0)

Updates `scipy` to 1.17.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.14.0...v1.17.1)

Updates `pybids` to 0.22.0
- [Release notes](https://github.com/bids-standard/pybids/releases)
- [Changelog](https://github.com/bids-standard/pybids/blob/main/CHANGELOG.rst)
- [Commits](bids-standard/pybids@0.18.0...0.22.0)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.18.5
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: build
  dependency-version: 1.5.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 49.0.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: fastapi
  dependency-version: 0.140.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: httpx
  dependency-version: 0.28.1
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: monai
  dependency-version: 1.6.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: nibabel
  dependency-version: 5.4.2
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: numpy
  dependency-version: 2.4.6
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: opacus
  dependency-version: 1.6.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: openai
  dependency-version: 2.48.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: prometheus-client
  dependency-version: 0.26.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: psycopg
  dependency-version: 3.3.4
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pybids
  dependency-version: 0.22.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: pydantic-settings
  dependency-version: 2.14.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pydicom
  dependency-version: 3.0.2
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: pyjwt
  dependency-version: 2.13.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ruff
  dependency-version: 0.16.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: scipy
  dependency-version: 1.17.1
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: sqlmodel
  dependency-version: 0.0.39
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: uvicorn
  dependency-version: 0.51.0
  dependency-type: direct:production
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-runtime-cffe286adf branch from 58373a8 to d850566 Compare July 26, 2026 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants