Skip to content

chore(deps): bump the python-deps group across 1 directory with 5 updates - #60

Merged
daggerstuff merged 1 commit into
masterfrom
dependabot/pip/python-deps-8b70da9b5f
Oct 14, 2026
Merged

chore(deps): bump the python-deps group across 1 directory with 5 updates#60
daggerstuff merged 1 commit into
masterfrom
dependabot/pip/python-deps-8b70da9b5f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastmcp, typer, fastembed, pypdf and ruff to permit the latest version.
Updates fastmcp to 4.1.0

Release notes

Sourced from fastmcp's releases.

v4.1.0: Fourth and One

FastMCP 4.1.0 is a maintenance release at heart: a broad sweep of fixes across OpenAPI, proxies, auth, tasks, and the CLI, plus full Python 3.15 support. It doesn't change how most servers behave. A few security fixes do tighten inputs that FastMCP previously accepted, though, and our versioning policy keeps breaking changes out of patch releases, so this ships as a point-one release.

Check these before upgrading:

  • MultiAuth now qualifies client IDs by source, so existing MultiAuth sessions and tasks start new ownership scopes. Finish pending tasks before upgrading.
  • Regex tool search uses Pydantic's regex engine, which doesn't support lookarounds or backreferences.
  • Skill files must resolve inside their configured directories.
  • OpenAPI path parameters reject . and .. segments.
  • HTTP sessions now expire after the MCP SDK's 30-minute idle default instead of never.
  • CodeMode requires Monty 1.1, which renames max_duration_secs to max_feed_duration_secs.

Thanks to our 48 contributors, including 21 first-time contributors!

What's Changed

Breaking Changes ⚠️

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.0: Fourth and One

FastMCP 4.1.0 is a maintenance release at heart: a broad sweep of fixes across OpenAPI, proxies, auth, tasks, and the CLI, plus full Python 3.15 support. It doesn't change how most servers behave. A few security fixes do tighten inputs that FastMCP previously accepted, though, and our versioning policy keeps breaking changes out of patch releases, so this ships as a point-one release.

Check these before upgrading:

  • MultiAuth now qualifies client IDs by source, so existing MultiAuth sessions and tasks start new ownership scopes. Finish pending tasks before upgrading.
  • Regex tool search uses Pydantic's regex engine, which doesn't support lookarounds or backreferences.
  • Skill files must resolve inside their configured directories.
  • OpenAPI path parameters reject . and .. segments.
  • HTTP sessions now expire after the MCP SDK's 30-minute idle default instead of never.
  • CodeMode requires Monty 1.1, which renames max_duration_secs to max_feed_duration_secs.

Thanks to our 48 contributors, including 21 first-time contributors!

Breaking Changes ⚠️

Enhancements ✨

Security 🔒

Fixes 🐞

... (truncated)

Commits
  • 51b618f Merge pull request #5635 from PrefectHQ/docs/changelog-4.1.0
  • e8327ee docs: structure v4.1.0 release notes
  • d7186ba docs: exclaim v4.1.0 contributor thanks
  • d87d171 docs: add v4.1.0 changelog entries
  • f3cf3ee chore: Update SDK documentation (#5465)
  • 1ed0e6d fix(client): hydrate formatted scalars and positional array items (#5203)
  • f6cfbf7 fix(docstrings): don't leak Returns/Raises into description for parameterless...
  • aa6aac8 fix: preserve input requests in resource and prompt tools (#5476)
  • 0921c96 fix(resources): separate URI fragments from query values (#5132)
  • f8439a3 Propagate child cancellation from gather (#5161)
  • Additional commits viewable in compare view

Updates typer to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

... (truncated)

Commits

Updates fastembed to 0.9.0

Release notes

Sourced from fastembed's releases.

v0.9.0

Changelog

Features 🏎️

Fixes 🔧

Upgrade Notes

  • Built-in models now download from Hugging Face only, without the Google Cloud Storage (GCS) fallback some of them had. The GCS buckets stay open, so older versions keep working, and custom models still support both url and hf sources. GCS copies cached by older versions still load offline or when Hugging Face is unreachable, with a FutureWarning: load the model once online, then delete its fast-<model name> dir.
  • We removed a stray 128-token limit from the Hugging Face configs of sentence-transformers/all-MiniLM-L6-v2 and Qdrant/bm42-all-minilm-l6-v2-attentions (now 256 tokens), and thenlper/gte-large and prithivida/Splade_PP_en_v1 (now 512). This applies to any fastembed version on a fresh download, and embeddings of texts over 128 tokens change. A cached model keeps the old limit until you delete it from the cache.
  • Qdrant/colmodernvbert now loads model_v2.onnx and drops padding rows from its embeddings, so offline setups need to download it first. Re-embed images that were embedded in batches with images of other aspect ratios. The model needs onnxruntime>=1.19.
  • LateInteractionMultimodalEmbedding.embed_image now defaults to batch_size=2 instead of 16, which also applies to Qdrant/colpali-v1.3-fp16.
  • jinaai/jina-clip-v1 image embeddings change for some image sizes.

Thanks to everyone who contributed to this release @​adityaanikam @​Aryan-SINGH-GIT @​Dmheath1 @​Dylancouzon @​FU-max-boop @​HuaTNA @​hulkbig @​JesusMan0529 @​Mirochill @​Mohith26 @​Pothan0 @​RAMZI0TO99 @​tekumara @​tuanzirwar @​joein

Commits
  • 539499b bump version to v0.9.0 (#789)
  • b2e7deb chore: remove redundant comment (#788)
  • 3c26701 fix: show progress bars when downloading new or corrupted model files (#787)
  • db785ee fix: ColModernVBERT tile grids, mixed-size image batches and fast text querie...
  • c0588ac new: create an issue when weekly ci fails (#781)
  • 0abff4d new: check wheel before publishing (#783)
  • b566dcb fix: don't fail a download when an older revision is cached (#780)
  • 0db8d09 docs: show full supported model names (#637)
  • 02563ea feat: Add lightonai/LateOn model (#643)
  • 6b1e1d2 new: add weekly ci to test all models (#767)
  • Additional commits viewable in compare view

Updates pypdf to 6.20.0

Release notes

Sourced from pypdf's releases.

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

New Features (ENH)

Performance Improvements (PI)

Bug Fixes (BUG)

Robustness (ROB)

Developer Experience (DEV)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.20.0, 2026-10-09

Security (SEC)

  • Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

  • Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

  • Parse an embedded CFF font program once per stream (#4164)
  • Parse numbers, indirect references, names and nulls faster (#4148)
  • Do not inherit PdfObject from a Protocol (#4149)
  • Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

  • Report the correct page number for identical pages (#4154)
  • Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

Robustness (ROB)

  • Accept an %%EOF marker that is not at the start of a line (#4136)
  • Font / _cmapy.py: More robust guards around fontTools (#4157)
  • Flatten the page tree iteratively (#4107)
  • Ignore invalid character codes for TrueType and Type1 font widths (#4117)
  • Restrict values to allowed range in CCITTFaxDecode (#4115)
  • Drop a /Kids entry resolving to null instead of raising a cycle error (#4108)

Developer Experience (DEV)

  • Declare official support for Python 3.15
  • Declare protocol data members on PdfReader and PdfWriter (#4106)

Full Changelog

Version 6.19.0, 2026-09-16

Security (SEC)

  • Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

  • Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

  • Move static value out of loop body for appearance stream data (#4087)
  • Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

  • Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
  • Use page reference for existing internal link targets (#4076)
  • Arabic-Indic digits are reversed during text extraction (#4077)
  • Parse a string rect for add_uri into a rectangle (#4074)

... (truncated)

Commits
  • 0309ab7 REL: 6.20.0
  • 80a84d4 SEC: Limit work per stream (filter count, accumulated decoding work) (#4173)
  • 4c20fa8 DEV: Declare official support for Python 3.15
  • c64a4e4 ROB: Skip a Tj operator whose operand is not a string (#4171)
  • 4714175 MAINT: Fix A001 (Variable is shadowing a Python builtin) (#4167)
  • 921d778 ROB: Accept an %%EOF marker that is not at the start of a line (#4136)
  • 1a6b050 ROB: Skip a TJ operator whose operand is not an array (#4166)
  • 5b6a77a PI: Parse an embedded CFF font program once per stream (#4164)
  • 79423c1 PI: Parse numbers, indirect references, names and nulls faster (#4148)
  • 37e1cd6 ROB: Handle EOF when reading standard xref table (#4170)
  • Additional commits viewable in compare view

Updates ruff to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

@dependabot
chore(deps): bump the python-deps group across 1 directory with 5 upd…
9f1c1e3 
…ates

Updates the requirements on [fastmcp](https://github.com/PrefectHQ/fastmcp), [typer](https://github.com/fastapi/typer), [fastembed](https://github.com/qdrant/fastembed), [pypdf](https://github.com/py-pdf/pypdf) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version.

Updates `fastmcp` to 4.1.0
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.0.10...v4.1.0)

Updates `typer` to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `fastembed` to 0.9.0
- [Release notes](https://github.com/qdrant/fastembed/releases)
- [Changelog](https://github.com/qdrant/fastembed/blob/main/RELEASE.md)
- [Commits](qdrant/fastembed@v0.8.1...v0.9.0)

Updates `pypdf` to 6.20.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.19.0...6.20.0)

Updates `ruff` to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.17.0)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.0
  dependency-type: direct:production
  dependency-group: python-deps
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: fastembed
  dependency-version: 0.9.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: pypdf
  dependency-version: 6.20.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@daggerstuff
daggerstuff merged commit 1662b6a into master Oct 14, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-deps-8b70da9b5f branch October 14, 2026 13:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@daggerstuff