Skip to content

chore(deps): bump the python-runtime group in /backend_api_python with 7 updates - #292

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-08a1705a2f
Open

chore(deps): bump the python-runtime group in /backend_api_python with 7 updates#292
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-08a1705a2f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, aiohttp, ta-lib, litellm, confluent-kafka, redis and pypdf to permit the latest version.
Updates ruff to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates aiohttp to 3.14.5
Updates ta-lib from 0.8.1 to 0.8.2

Release notes

Sourced from ta-lib's releases.

v0.8.2

  • [NEW]: Support free-threaded CPython without enabling the GIL on import.

  • [NEW]: Include Python 3.15 wheels.

Changelog

Sourced from ta-lib's changelog.

0.8.2

  • [NEW]: Support free-threaded CPython without enabling the GIL on import.
Commits
  • 1543b71 .github: ignore 3.9 and 3.10 for now
  • cb94803 .github: not sure why v4 doesn't resolve
  • 403d443 .github/workflows: update
  • 4f7bf2e Bump version to 0.8.2 and document threading support
  • ce84452 Support free-threaded Python and release the GIL around native work
  • See full diff in compare view

Updates litellm to 1.105.0

Release notes

Sourced from litellm's releases.

v1.105.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.105.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 80b9556 Merge pull request #45927 from BerriAI/litellm_ui_bundle_rc_1_105_0
  • 919f027 chore: update Next.js build artifacts (2026-10-11 06:00 UTC, node v24.19.0)
  • f15af9b feat(ui): backport decision auto-router setup to 1.105 (#45915)
  • 2616b1a Merge pull request #45905 from BerriAI/litellm_backport_decisions_rc_1_105_0
  • fcbb022 chore(backport): merge rc/1.105.0 and move supported_decisions_providers to l...
  • 23fec69 test(unit): flush queued logging tasks after each test so systemone callback ...
  • 212b42e chore(backport): regenerate dashboard API types and adapt the picks to rc/1.1...
  • f26cff4 feat(sdk): add litellm.systemone and trim litellm.decisions to the OpenAI sha...
  • 4032305 test(decisions): bill the OpenAI-format openrouter case from provider-reporte...
  • 8f262b2 docs(proxy): describe /v1/decisions and /v1/systemone in Swagger UI (#45838)
  • Additional commits viewable in compare view

Updates confluent-kafka to 2.16.0

Release notes

Sourced from confluent-kafka's releases.

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

  • confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
  • Add Python 3.14t wheels (#2352)
  • Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
  • Producer close() now aborts any open transaction (#2347)
  • Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
  • SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
  • Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
  • New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
  • New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
  • New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
  • Add support for saving Azure key version with DEK (#2306)
  • Pass context when clients make KEK calls to DEK Registry (#2308)
  • Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
  • Add support for inline validation rules (#2326)
  • Add Variant, Decimal, and Timestamp CEL functions (#2332)

Fixes

... (truncated)

Changelog

Sourced from confluent-kafka's changelog.

v2.16.0

v2.16.0 is a feature release with the following features, fixes and enhancements:

Enhancements

  • confluent_kafka now declares itself GIL-safe, enabling real multi-core parallelism on free-threaded CPython builds. See the Multithreading Guide for thread-safety details and free-threaded caveats. (#2347)
  • Add Python 3.14t wheels (#2352)
  • Add Linux s390x (IBM Z) wheels, including Python 3.14t (#2360)
  • Producer close() now aborts any open transaction (#2347)
  • Async IO Consumer's default worker pool size has been increased from 2 to 100 (#2347)
  • Add support for CPython free-threading (PEP 703) to enable true multi-core parallel execution in No-GIL environments (#2347)
  • SerializingProducer and DeserializingConsumer accept a serde builder when not passing a ready-made serde, through the new key.serializer.builder / value.serializer.builder and key.deserializer.builder / value.deserializer.builder configuration properties. Serdes built this way, and any Schema Registry client the builder created for them, are owned by the client and closed by its close(); ready-made serdes remain the application's. This API is experimental (#2364).
  • Serdes that resolve subjects through the Schema Registry associated subject name strategy are now given the Kafka cluster id automatically. The id is resolved lazily, on the first subject lookup, so creating a client never waits on a broker, and concurrent lookups share a single cluster_id() call; until a broker has been reached the lookup raises a SerializationError naming subject.name.strategy.kafka.cluster.id, which can be set to supply the id explicitly. The new serde hooks (set_cluster_id_resolver(), close()) are experimental (#2364).
  • New Producer.cluster_id(), Consumer.cluster_id() and AdminClient.cluster_id() (also on AIOProducer and AIOConsumer), returning the id of the cluster the client is connected to. This API is experimental (#2364).
  • New asyncio clients AsyncSerializingProducer and AsyncDeserializingConsumer in confluent_kafka.aio, the counterparts of SerializingProducer and DeserializingConsumer built on AIOProducer / AIOConsumer, accepting the asyncio Schema Registry serdes and their builders. These classes are experimental (#2364).
  • New Message.deserialized_key() and Message.deserialized_value(), which return the same objects as key() and value() but are typed with the deserialized types on a DeserializingConsumer. SerializingProducer and DeserializingConsumer are now generic in their key and value types. This API is experimental (#2364).
  • Add support for saving Azure key version with DEK (#2306)
  • Pass context when clients make KEK calls to DEK Registry (#2308)
  • Schema Registry: add support for the DLQ (dead-letter-queue) rule action (DlqAction). When a rule fails, the record is teed to a configured DLQ topic and the original serialize/deserialize call still raises. With the default (global) RuleRegistry the DLQ is best-effort; set dlq.auto.flush=true or give the serde its own RuleRegistry (closable on shutdown) for durability.
  • Add support for inline validation rules (#2326)
  • Add Variant, Decimal, and Timestamp CEL functions (#2332)

... (truncated)

Commits
  • 4a1bcb0 Copy pyproject.toml into smoketest temp dir so asyncio_mode=auto applies (#2384)
  • 16ba967 Fix Unicode errors in string serialization (#2379)
  • 73a71f8 2.16.0 (#2380)
  • 20614ae Integrate Schema Registry serdes into the Kafka clients: serde builders, clus...
  • 7f2e72f Add s390x wheels to the build and verification matrix (#2360)
  • 6a54a83 chore: normalize service.yml field names (#2193)
  • c57c5b8 Fix Producer.purge() ignoring boolean flags on big-endian platforms (#2345)
  • 89c99e0 On Windows, the tag isn't currently given when building librdkafka, that affe...
  • cc1c970 v2.16.0rc2 (#2369)
  • d245efd Fix crash on nullable array of $ref items in JSON Schema CSFLE (#2370)
  • Additional commits viewable in compare view

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

  • Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
  • Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
  • Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
  • Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
  • Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
  • Sentinel — replica sentinel aliases (#4127).

🚀 New Features

  • Add replica sentinel aliases (#4127)
  • Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
  • feat: add TS.READ command support to the timeseries module (#4170)
  • feat: add SDIFFCARD and SUNIONCARD command support (#4171)
  • feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
  • feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
  • feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
  • feat: add COLLECT reducer support to search aggregations (#4179)
  • feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
  • feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
  • feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

  • feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

  • fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
  • Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits
  • e013126 Testing with 8.10 GA (#4227)
  • 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
  • d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
  • fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
  • 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
  • 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
  • 227280a Update lib version to 8.1.0
  • 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
  • 599fd75 feat: add FT.ALIASLIST support (#4198)
  • 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
  • Additional commits viewable in compare view

Updates pypdf to 6.20.1

Release notes

Sourced from pypdf's releases.

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

Bug Fixes (BUG)

  • Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.20.1, 2026-10-12

Security (SEC)

  • Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

  • Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Version 6.20.0, 2026-10-09

Security (SEC)

  • Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

  • Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

  • Parse an embedded CFF font program once per stream (#4164)
  • Parse numbers, indirect references, names and nulls faster (#4148)
  • Do not inherit PdfObject from a Protocol (#4149)
  • Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

  • Report the correct page number for identical pages (#4154)
  • Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

Robustness (ROB)

  • Accept an %%EOF marker that is not at the start of a line (#4136)
  • Font / _cmapy.py: More robust guards around fontTools (#4157)
  • Flatten the page tree iteratively (#4107)
  • Ignore invalid character codes for TrueType and Type1 font widths (#4117)
  • Restrict values to allowed range in CCITTFaxDecode (#4115)
  • Drop a /Kids entry resolving to null instead of raising a cycle error (#4108)

Developer Experience (DEV)

  • Declare official support for Python 3.15
  • Declare protocol data members on PdfReader and PdfWriter (#4106)

Full Changelog

Version 6.19.0, 2026-09-16

Security (SEC)

  • Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

  • Replace PdfWriter method add_js (#3979)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-runtime group
eee1a7f 
---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ta-lib
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.105.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: confluent-kafka
  dependency-version: 2.16.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pypdf
  dependency-version: 6.20.1
  dependency-type: direct:production
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants