Skip to content

deps: bump the python-dependencies group across 1 directory with 7 updates - #353

Merged
MattJColes merged 2 commits into
mainfrom
dependabot/uv/python-dependencies-da90669d0d
Aug 2, 2026
Merged

deps: bump the python-dependencies group across 1 directory with 7 updates#353
MattJColes merged 2 commits into
mainfrom
dependabot/uv/python-dependencies-da90669d0d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 7 updates in the / directory:

Package From To
litellm 1.93.0 1.94.0
boto3 1.43.56 1.43.60
ruff 0.16.0 0.16.1
semgrep 1.171.0 1.172.0
aws-cdk-lib 2.262.1 2.262.2
aws-cdk-aws-lambda-python-alpha 2.262.1a0 2.262.2a0
constructs 10.7.1 10.8.0

Updates litellm from 1.93.0 to 1.94.0

Release notes

Sourced from litellm's releases.

v1.94.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 38f2e02 Merge pull request #34995 from BerriAI/litellm_/cost-optimization-savings-pr-...
  • 4d06852 chore: update Next.js build artifacts (2026-07-28 19:58 UTC, node v20.20.2)
  • 7880e61 Merge pull request #34994 from BerriAI/litellm_/cost-optimization-savings-pr-...
  • 99618fb feat(cost-optimization): anchor the savings line at a $0 range start
  • 3322f24 fix(cost-optimization): replace savings methodology Collapse with per-card in...
  • d3c8e5a Merge pull request #34982 from BerriAI/litellm_/release-ui-build-1-94-0-ff6e5a
  • 1e85794 chore: update Next.js build artifacts (2026-07-28 19:23 UTC, node v20.20.2)
  • 96103c9 Merge pull request #34987 from BerriAI/litellm_/cherry-pick-34984-rc-1-94-0-7...
  • 3db78a8 feat(ui): mark Cost Optimization as beta in the left nav (#34984)
  • 81ab74e Merge pull request #34967 from BerriAI/litellm_rc194_cost_optimization_page_m...
  • Additional commits viewable in compare view

Updates boto3 from 1.43.56 to 1.43.60

Commits

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Updates semgrep from 1.171.0 to 1.172.0

Release notes

Sourced from semgrep's releases.

Release v1.172.0

1.172.0 - 2026-07-28

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)
  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)
  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)
Changelog

Sourced from semgrep's changelog.

1.172.0 - 2026-07-28

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)
  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)
  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)

1.170.0 - 2026-07-15

### Added

  • Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
  • Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
  • semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

  • Increased the timeout for dynamic dependency resolution subprocesses from

... (truncated)

Commits
  • 651f37e chore: release 1.172.0
  • 9273440 chore(ruby): bump semgrep-ruby to C API scanner (tree-sitter 0.26.3) (semgrep...
  • d154edb atd: invert exclude_binary_files → optional include_binary_files (semgrep/sem...
  • 5f976e2 chore(testo): remove testo pin and bump to 0.5.0 (semgrep/semgrep-proprietar...
  • 2515f3asemgrep/semgrep-proprietary#6803
  • e086f55semgrep/semgrep-proprietary#6705
  • 51cf5a9 fix(CLI): Only print non-zero product fragments (semgrep/semgrep-proprietary#...
  • 914b610semgrep/semgrep-proprietary#6775
  • d6fad57 fix(metrics): improve install-semgrep-pro error reporting (semgrep/semgrep-pr...
  • 7182c0asemgrep/semgrep-proprietary#6791
  • Additional commits viewable in compare view

Updates aws-cdk-lib from 2.262.1 to 2.262.2

Release notes

Sourced from aws-cdk-lib's releases.

v2.262.2

Bug Fixes

Alpha modules (2.262.2-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.263.0-alpha.0 (2026-07-31)

⚠ BREAKING CHANGES

  • mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

Bug Fixes

2.262.2-alpha.0 (2026-07-29)

2.262.1-alpha.0 (2026-07-23)

2.262.0-alpha.0 (2026-07-22)

Bug Fixes

  • redshift-alpha: quote identifiers and escape literals containing special characters (#38269) (3cb6844)

2.261.0-alpha.0 (2026-07-02)

Features

  • metrics-facade-alpha: generate metrics facades (#37334) (aa9beb0)

2.260.0-alpha.0 (2026-06-16)

2.259.0-alpha.0 (2026-06-11)

2.258.1-alpha.0 (2026-06-08)

2.258.0-alpha.0 (2026-06-04)

Features

  • integ-tests-alpha: add option to set the provider log level (#38005) (c634a79)

Bug Fixes

... (truncated)

Commits
  • f52698c chore(release): 2.262.2 (#38438)
  • b3dfdd8 chore(release): 2.262.2
  • 07d3334 chore(core): regression test for nested stack DependsOn blowup (#38406) (#38431)
  • d97dd8d fix: revert "fix(core): stack.node.addDependency gets slower as stacks grow (...
  • ec207df chore(rosetta): upgrade jsii-rosetta and add batch flag (#36389)
  • See full diff in compare view

Updates aws-cdk-aws-lambda-python-alpha from 2.262.1a0 to 2.262.2a0

Release notes

Sourced from aws-cdk-aws-lambda-python-alpha's releases.

v2.262.1

Bug Fixes

  • core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#38382) (d409b96), closes #38380
  • core: env CDK_VALIDATION=false does not disable built-in template validation (#38379) (cc4208c), closes #38378

Alpha modules (2.262.1-alpha.0)

Commits

Updates constructs from 10.7.1 to 10.8.0

Release notes

Sourced from constructs's releases.

v10.8.0

10.8.0 (2026-07-30)

Features

  • constructs: restrict package exports to public API (#2878) (9f11c08)

v10.7.2

10.7.2 (2026-07-29)

Bug Fixes

  • ids with a newline can produce duplicate addresses (#2876) (25edded)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the python-dependencies group across 1 directory with 7 up…
5aa0aad 
…dates

Bumps the python-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [litellm](https://github.com/BerriAI/litellm) | `1.93.0` | `1.94.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.56` | `1.43.60` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.1` |
| [semgrep](https://github.com/semgrep/semgrep) | `1.171.0` | `1.172.0` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk) | `2.262.1` | `2.262.2` |
| [aws-cdk-aws-lambda-python-alpha](https://github.com/aws/aws-cdk) | `2.262.1a0` | `2.262.2a0` |
| [constructs](https://github.com/aws/constructs) | `10.7.1` | `10.8.0` |



Updates `litellm` from 1.93.0 to 1.94.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.93.0...v1.94.0)

Updates `boto3` from 1.43.56 to 1.43.60
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.56...1.43.60)

Updates `ruff` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.1)

Updates `semgrep` from 1.171.0 to 1.172.0
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.171.0...v1.172.0)

Updates `aws-cdk-lib` from 2.262.1 to 2.262.2
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](aws/aws-cdk@v2.262.1...v2.262.2)

Updates `aws-cdk-aws-lambda-python-alpha` from 2.262.1a0 to 2.262.2a0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits)

Updates `constructs` from 10.7.1 to 10.8.0
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](aws/constructs@v10.7.1...v10.8.0)

---
updated-dependencies:
- dependency-name: litellm
  dependency-version: 1.94.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: boto3
  dependency-version: 1.43.60
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: semgrep
  dependency-version: 1.172.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: aws-cdk-lib
  dependency-version: 2.262.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: aws-cdk-aws-lambda-python-alpha
  dependency-version: 2.262.2a0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: constructs
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 2, 2026
@MattJColes
MattJColes merged commit 5c7f220 into main Aug 2, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-dependencies-da90669d0d branch August 2, 2026 23:20
@github-actions github-actions Bot mentioned this pull request Aug 2, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MattJColes