Skip to content

build(requirements): bump the prod group with 10 updates - #4

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/prod-32ead93547
Closed

build(requirements): bump the prod group with 10 updates#4
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/prod-32ead93547

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown

Updates the requirements on litellm, azure-identity, streamlit, pydantic-ai-slim, ruff, snowballstemmer, dill, pillow, psutil and scipy to permit the latest version.
Updates litellm from 1.97.0 to 1.100.1

Release notes

Sourced from litellm's releases.

v1.100.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.100.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.100.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.100.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.100.0...v1.100.1

v1.100.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

... (truncated)

Commits
  • 1dba17b Merge pull request #40495 from BerriAI/litellm_revert_1_100_x_spend_backports
  • dec2c2a Revert "fix(spend-tracking): keep batch spend keys joinable after v1.99 prove...
  • d7198f4 Revert "fix(spend-tracking): keep internal service-account key names readable...
  • e4e811c Merge pull request #40455 from BerriAI/litellm_backport_1_100_x_retry_breadcr...
  • a9ea571 test(router): type the breadcrumb test helpers
  • 76b5fec fix(router): keep retry breadcrumbs per request and out of the request snapshot
  • ecc04bf Merge pull request #40176 from BerriAI/litellm_backport_1_100_x_spend_key_hash
  • 0b176c3 chore: refresh uv.lock for 1.100.1
  • 8b0ae02 bump: version 1.100.0 -> 1.100.1
  • c2e18a4 fix(spend-tracking): keep internal service-account key names readable in spen...
  • Additional commits viewable in compare view

Updates azure-identity from 1.17.1 to 1.25.3

Release notes

Sourced from azure-identity's releases.

azure-ai-evaluation_1.18.5

1.18.5 (2026-09-02)

Bugs Fixed

  • Made Application Insights export failures best-effort for evaluations using project managed identity authentication.

  • Fixed keyword argument routing so bare messages=[...] input, with optional top-level context, ground_truth, and tool_definitions, is normalized into the already-supported conversation path for RelevanceEvaluator, SimilarityEvaluator, FluencyEvaluator, RetrievalEvaluator, ResponseCompletenessEvaluator, ViolenceEvaluator, HateUnfairnessEvaluator, SelfHarmEvaluator, SexualEvaluator, ProtectedMaterialEvaluator, IndirectAttackEvaluator, CodeVulnerabilityEvaluator, and ECIEvaluator. Existing scalar and conversation={...} input semantics are unchanged. #48629

Commits

Updates streamlit to 1.63.0

Release notes

Sourced from streamlit's releases.

1.63.0

What's Changed

New Features 🎉

Bug Fixes 🐛

Other Changes

... (truncated)

Commits
  • cb9aba9 Up version to 1.63.0
  • 158822c [fix] Keep a time given before a date in st.datetime_input (#16664)
  • a039406 [fix] Prevent upload hang when middleware reads the body first (#16709)
  • 913f77c [docs] Update agent skill for keyed fragment reruns (#16750)
  • 1614093 [docs] Document that st.rerun() works in widget callbacks (#16751)
  • d330f58 [fix] Log all user-facing warnings to the console (#16717)
  • a1bdd67 [feature] Add event-scoped fragment reruns via st.rerun(scope=<key>) (#16161)
  • da485ea [chore] Fix click, uvloop, knip, and teardown test warnings (#16735)
  • c714cfe [chore] Add papercut auto-select and final AI review (#16731)
  • 976187b [chore] Pin patched frontend security dependencies (#16748)
  • Additional commits viewable in compare view

Updates pydantic-ai-slim from 1.66.0 to 2.43.0

Release notes

Sourced from pydantic-ai-slim's releases.

v2.43.0 (2026-09-11)

What's Changed

🚀 Features

🐛 Bug Fixes

New Contributors

Full Changelog: pydantic/pydantic-ai@v2.42.0...v2.43.0

v2.42.0 (2026-09-08)

What's Changed

⚠️ Compatibility Notes

🚀 Features

🐛 Bug Fixes

New Contributors

Full Changelog: pydantic/pydantic-ai@v2.41.0...v2.42.0

v2.41.0 (2026-09-07)

What's Changed

🚀 Features

🐛 Bug Fixes

New Contributors

... (truncated)

Changelog

Sourced from pydantic-ai-slim's changelog.

Upgrade Guide

In September 2025, Pydantic AI reached V1 and committed to API stability: no changes that break your code until V2. V2 is now available, collecting the breaking and behavior changes that stability guarantee didn't allow. This guide is the canonical place to learn what's in V2, how to install it, and how to upgrade; for the guarantees behind these version numbers, see the Version Policy.

Breaking Changes

Here's a filtered list of the breaking changes for each version to help you upgrade Pydantic AI.

v2.0.0 (2026-06-23)

The stable V2.0 release. There are no new breaking or behavior changes since the betas; the full breaking-change list and recommended upgrade path are in the v2.0.0b1 entry below. Install it with:

uv add pydantic-ai

v2.0.0b7 (2026-06-10)

The seventh V2 beta, forked from v1.107.0. There are no new V2 breaking or behavior changes since v2.0.0b6 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds Claude Fable 5 / Mythos 5 model support and OpenRouter prompt caching (CachePoint), plus known_model_names() and Anthropic fixes; see the v1.107.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b7"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.107.0.

v2.0.0b6 (2026-06-04)

The sixth V2 beta, forked from v1.106.0. There are no new V2 breaking or behavior changes since v2.0.0b5 below — everything in that entry applies unchanged — but this beta picks up the latest V1 release on top, which adds api_host/timeout configuration and base seed mapping for the xAI provider, plus streaming and data-URI handling fixes; see the v1.106.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b6"

For the full breaking-change list and the recommended upgrade path, see the v2.0.0b1 entry below; the only difference is that the latest V1 to upgrade through first is now v1.106.0.

v2.0.0b5 (2026-06-02)

The fifth V2 beta, forked from v1.105.0. There are no new V2 breaking or behavior changes since v2.0.0b4 below — everything in that entry (including the prepare-callbacks change) still applies — but this beta picks up the latest V1 release on top, which adds on-demand (deferred-loading) capabilities and Grok 4.3 reasoning_effort support, plus GoogleModelSettings.google_cached_content and Temporal gateway/ fixes; see the v1.105.0 release notes for the full list.

Install it the same way, pinning the exact pre-release version:

pip/uv-add "pydantic-ai==2.0.0b5"

... (truncated)

Commits
  • 86b250f Add a Comparisons section covering 10 agent frameworks (#8260)
  • fbd2beb Add a first-run banner describing the run, and open clai sessions with it (...
  • f6afee2 fix(temporal): key tool opt-out checks on operation kind, not an MCP import (...
  • f998089 Preserve text part boundaries after tool calls in OpenAIChatModel (#8235)
  • 23a48cf Fix realtime and durable-execution skill guidance (#8086)
  • cda77a7 Revert the instrumenting-pydantic-ai skill (#8267)
  • 5aecb14 Add an instrumenting-pydantic-ai skill for the first-run banner to point at...
  • a2f3272 Use client ID for docs workflows (#8256)
  • 5facbe5 Raise the JSON call budget above the noise it flakes on (#8245)
  • 0ec8a5d Preserve Anthropic recovery across normalized history (#8040)
  • Additional commits viewable in compare view

Updates ruff from 0.15.12 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Commits

Updates snowballstemmer to 3.1.1

Changelog

Sourced from snowballstemmer's changelog.

Snowball 3.1.1 (2026-06-03)

Compiler changes

  • Bug fixes:

    • Fix a segmentation fault after reporting an error for a string command not followed by a string variable name or string literal. Bug introduced in 3.1.0. Patch from Jerry James (#287).

  • Compiler command-line options:

    • Emit an error for -o -/-output -. Output to stdout is not supported because we need to generate multiple files for some target languages. We were interpreting - as a base filename to append extensions to, so we'd create -.c and -.h for C, but creating filenames that start with - seems unhelpful.

Generic code generation changes

  • Bug fixes:

    • Variable localisation was failing to check the expression on the RHS of an integer test for uses of a variable, so could incorrectly localise an integer variable whose value should have persisted between calls to a function. This bug won't realistically manifest in real world Snowball code.

  • Optimisations:

    • Inline some routines which are only used once. This is done for routines consisting of a single non-compound command (or cases such as not <boolean> and goto <grouping> which we internally synthesise a non-compound command for). Localisation of variables happens after inlining, so variables can now be localised in more cases.

    • test next and not next are both now simplified to a comparison between cursor and limit (like not atlimit and atlimit). We already normalise hop 1 to next, so test hop 1 and not hop 1 are also simplified in this way.

    • Simplify not applied to an integer test by removing the not and flipping the sense of the test (e.g. not $(x > y) becomes $(x <= y)) which results in simpler generated code. More usefully in real world code, this also results in simpler generated code for not atlimit (since atlimit is converted $(cursor >= limit) or $(cursor <= limit) (depending on the current direction).

... (truncated)

Commits
  • cd195b5 Update for 3.1.1
  • 80d885c NEWS: Update draft entry
  • 5346c74 C++: Compile runtime as C++
  • 537f970 python: Add classifier for 3.14
  • 3aeb013 python: Skip Natural Language :: Sesotho classifier
  • 91fa20b NEWS: Update draft entry
  • a04abeb Don't use extern "C" for functions which can throw
  • 49bb623 C++: Hook up properly
  • 7ab50ed CI: Fix coverage job
  • 5f0a33c NEWS: Add draft entry
  • Additional commits viewable in compare view

Updates dill from 0.3.9 to 0.4.1

Commits

Updates pillow from 10.4.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

11.0.0 (2024-10-15)

  • Update licence to MIT-CMU #8460 [hugovk]

  • Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

  • Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

  • Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

  • Do not close provided file handles with libtiff when saving #8458 [radarhere]

  • Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

  • Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

  • Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

  • Use transparency when combining P frames from APNGs #8443 [radarhere]

  • Support all resampling filters when resizing I;16* images #8422 [radarhere]

  • Free memory on early return #8413 [radarhere]

  • Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits

mnbvcxz8 and others added 2 commits September 16, 2026 20:31
@mnbvcxz8 @claude
3rdmind: Research Studio on RD-Agent × Qlib
c1a2d27 
Factor research workbench: agent-driven hypothesis and factor generation
(RD-Agent), portfolio backtests, diagnosis and search on Qlib, strategies
with tracking and signal export, LLM and data settings in the UI.

Built on microsoft/RD-Agent (MIT notice in LICENSE.RD-Agent).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@dependabot
build(requirements): bump the prod group with 10 updates
56a7e17 
Updates the requirements on [litellm](https://github.com/BerriAI/litellm), [azure-identity](https://github.com/Azure/azure-sdk-for-python), [streamlit](https://github.com/streamlit/streamlit), [pydantic-ai-slim](https://github.com/pydantic/pydantic-ai), [ruff](https://github.com/astral-sh/ruff), [snowballstemmer](https://github.com/snowballstem/snowball), [dill](https://github.com/uqfoundation/dill), [pillow](https://github.com/python-pillow/Pillow), [psutil](https://github.com/giampaolo/psutil) and [scipy](https://github.com/scipy/scipy) to permit the latest version.

Updates `litellm` from 1.97.0 to 1.100.1
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.97.0...v1.100.1)

Updates `azure-identity` from 1.17.1 to 1.25.3
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-identity_1.17.1...azure-identity_1.25.3)

Updates `streamlit` to 1.63.0
- [Release notes](https://github.com/streamlit/streamlit/releases)
- [Commits](streamlit/streamlit@1.47.0...1.63.0)

Updates `pydantic-ai-slim` from 1.66.0 to 2.43.0
- [Release notes](https://github.com/pydantic/pydantic-ai/releases)
- [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md)
- [Commits](pydantic/pydantic-ai@v1.66.0...v2.43.0)

Updates `ruff` from 0.15.12 to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.12...0.16.7)

Updates `snowballstemmer` to 3.1.1
- [Changelog](https://github.com/snowballstem/snowball/blob/main/NEWS)
- [Commits](snowballstem/snowball@v2.0.0...v3.1.1)

Updates `dill` from 0.3.9 to 0.4.1
- [Release notes](https://github.com/uqfoundation/dill/releases)
- [Commits](uqfoundation/dill@0.3.9...0.4.1)

Updates `pillow` from 10.4.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@10.4.0...12.3.0)

Updates `psutil` from 6.1.0 to 7.2.2
- [Changelog](https://github.com/giampaolo/psutil/blob/master/docs/changelog.rst)
- [Commits](giampaolo/psutil@v6.1.0...v7.2.2)

Updates `scipy` from 1.14.1 to 1.15.3
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.14.1...v1.15.3)

---
updated-dependencies:
- dependency-name: litellm
  dependency-version: 1.100.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: azure-identity
  dependency-version: 1.25.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: streamlit
  dependency-version: 1.63.0
  dependency-type: direct:production
  dependency-group: prod
- dependency-name: pydantic-ai-slim
  dependency-version: 2.43.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: snowballstemmer
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: prod
- dependency-name: dill
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod
- dependency-name: psutil
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod
- dependency-name: scipy
  dependency-version: 1.15.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 16, 2026
@mailbobg mailbobg closed this Sep 16, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@mailbobg
mailbobg deleted the dependabot/pip/prod-32ead93547 branch September 16, 2026 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mailbobg @mnbvcxz8