Skip to content

chore(deps): bump the uv group across 1 directory with 5 updates - #66

Merged
daggerstuff merged 1 commit into
masterfrom
dependabot/uv/uv-498d35825d
Oct 26, 2026
Merged

chore(deps): bump the uv group across 1 directory with 5 updates#66
daggerstuff merged 1 commit into
masterfrom
dependabot/uv/uv-498d35825d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 5 updates in the / directory:

Package From To
fastmcp 4.1.0 4.1.2
pypdf 6.20.1 6.21.2
certifi 2026.7.22 2026.10.19
filelock 4.0.4 4.2.1
opentelemetry-api 1.44.0 1.45.1

Updates fastmcp from 4.1.0 to 4.1.2

Release notes

Sourced from fastmcp's releases.

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

Enhancements ✨

Fixes 🐞

Docs 📚

Examples & Contrib 💡

Other Changes 🦾

... (truncated)

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.1.3: Root Awakening

This release updates certifi-backed dependencies following the eMudhra CA compromise and fixes public-client OAuth authentication, empty visibility selections, generator transforms, and per-server timeouts for ordinary requests. FastMCP 4 uses system trust by default: follow the security notice to update operating-system, container, custom, and installer trust stores; upgrading FastMCP alone is insufficient. Thanks to our 11 contributors, including 6 first-time contributors.

Security 🔒

  • Require certifi 2026.10.19 or later for certifi-backed server dependencies and optional SDK integrations, and document system, custom, and installer trust-store updates by @​zzstoatzz in #5945.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v4.1.2...v4.1.3

v4.1.2: License to Deny

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

Security 🔒

Enhancements ✨

... (truncated)

Commits
  • 0f4674e docs: add v4.1.2 changelog entries (#5936)
  • 85df42f Enforce component authorization and bind OAuth credentials to an issuer (#5933)
  • 535a3e1 Remove stray logo.py and unused CodeRabbit config (#5873)
  • 49858c3 Keep disabled resources from being served by matching templates (#5876)
  • 9921d5e Add experimental Skills discovery to SkillsDirectoryProvider (#5704)
  • cb20ad6 Give the timeout-override test headroom for the follow-up tools/list (#5875)
  • 623590a Stop deploy tests from spawning PowerShell on every state access (#5874)
  • 70ac0ce context: stop documenting session_id as a cross-request key (#5862)
  • e1b3e57 Write down triage and merge norms in docs/development (#5872)
  • 78e1256 Raise ToolError when a tool with an output schema returns an unserializable v...
  • Additional commits viewable in compare view

Updates pypdf from 6.20.1 to 6.21.2

Release notes

Sourced from pypdf's releases.

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

New Features (ENH)

Bug Fixes (BUG)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.21.2, 2026-10-21

Security (SEC)

  • Avoid repeated full file loads (#4240)
  • Limit size of standard xref table (#4239)

Bug Fixes (BUG)

  • Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • Keep 8-bit DeviceRGB image mode (#4230)
  • Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

Security (SEC)

  • Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

  • Improve performance and limit field work (#4219)
  • Limit stream parsing work (#4218)

New Features (ENH)

  • Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

  • Treat NUL as whitespace in ArrayObject (#4198)
  • Avoid overwriting unread objects in add_form_topname (#4190)
  • Read an indirect page box on a writer page (#4179)

Full Changelog

Commits
  • 37d05f6 REL: 6.21.2
  • 68a0e50 SEC: Avoid repeated full file loads (#4240)
  • a3061e3 SEC: Limit size of standard xref table (#4239)
  • b7eb7b9 BUG: Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • 885e743 ROB: Reject unsupported key lengths in the /Encrypt dictionary (#4226)
  • b68a335 TST: Enable type checking for PageRange tests (#4229)
  • 3f9c7f4 ROB: Reject negative bfrange source ranges in /ToUnicode CMaps (#4225)
  • 85c46ab ROB: Raise PdfReadError for malformed /ObjStm /N and /First headers (#4216)
  • a91817a BUG: Keep 8-bit DeviceRGB image mode (#4230)
  • b32df1d ROB: Validate the /Encrypt dictionary when opening an encrypted file (#4197)
  • Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.19

Commits

Updates filelock from 4.0.4 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

  • On a singleton wrapper, close> and close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832
  • ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833
  • Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834
  • Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836
  • The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838
  • StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.2.4 (2026-10-19)

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

4.2.3 (2026-10-19)

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

4.2.2 (2026-10-18)

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

4.2.1 (2026-10-17)

  • On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
  • :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
  • Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits
  • 60331bb Release 4.2.1
  • 834bf13 🧪 test(soft): skip Unix pin test on Windows
  • 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
  • e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
  • 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
  • bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
  • 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
  • 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
  • 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
  • eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
  • Additional commits viewable in compare view

Updates opentelemetry-api from 1.44.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Version 1.45.0/0.66b0

Added

  • opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)
  • infra: add renovate (#5202)
  • opentelemetry-api, opentelemetry-sdk: add support for extended attribute values everywhere. (#5266)
  • opentelemetry-sdk: wire the top-level log_level field in declarative configuration — when set, maps the OTel SeverityNumber value to a Python logging level and applies it to the opentelemetry logger so SDK internal diagnostics respect the configured severity. (#5351)
  • opentelemetry-sdk: add the new stable AlwaysRecordSampler (#5354)
  • opentelemetry-configuration, opentelemetry-sdk: wire top-level attribute_limits into per-signal providers via declarative config; add log_record_limits support to LoggerProvider (#5365)
  • opentelemetry-exporter-otlp-json-http: add OTLP JSON HTTP exporter package (#5374)
  • opentelemetry-api, opentelemetry-sdk: add enabled() support to the Logger API, SDK, and LogRecordProcessor to let instrumentation skip expensive work when logging is disabled (#5380)
  • opentelemetry-exporter-otlp-json-file: add OTLP JSON file Docker tests (#5412)
  • opentelemetry-configuration: wire the experimental tracer_configurator/development, meter_configurator/development and logger_configurator/development fields into create_tracer_provider, create_meter_provider and create_logger_provider, so per-instrumentation-scope enabled overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger minimum_severity/trace_based fields are not supported by the Python SDK and are ignored with a warning. (#5418)
  • docs/examples: add example on how to manually setup the SDK to get SDK metrics (#5449)
  • opentelemetry-docker-tests: add Prometheus exporter docker tests (#5457)
  • opentelemetry-sdk: count records dropped after shutdown on otel.sdk.processor.{span,log}.processed with error.type=already_shutdown (batch span/log and simple log processors), which the semantic conventions define as a valid value for this metric. (#5509)
  • opentelemetry-semantic-conventions: update semantic conventions to v1.44.0 (#5511)
  • opentelemetry-sdk: add host.id to the host resource detector (#5653)
  • opentelemetry-test-utils: add CapturingSampler to record what samplers receive in instrumentation tests (#5681)

Changed

  • Enable PIE (flake8-pie) ruff rule and fix all violations (#5150)
  • The public opentelemetry.util.types.AttributeValue type in package opentelemetry-api is being expanded to include None, heterogeneous sequences of primitive types (and nested sequences) as opposed to only homogeneous primitive sequences, and Mappings of strings to any primitive types or sequences/mappings (which themselves must only contain primitive types or sequences/mappings validated the same way). If a bytes type is set as an attribute value in the SDK, it will no longer be utf-8 decoded to a string, instead it will be passed along as is in accordance with the OTEL spec, since bytes is a valid type in the OTLP proto. (#5266)
  • opentelemetry-exporter-otlp-proto-http: add a max_request_size argument to the OTLP HTTP exporters (traces, logs, metrics); serialized requests larger than the limit are dropped before sending, measured before compression. Defaults to 64 MiB (enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (#5369)
  • [BREAKING] opentelemetry-api: subclasses of Logger need to implement the enabled method (#5380)
  • opentelemetry-exporter-otlp-proto-http: refactor to use shared opentelemetry-exporter-otlp-common and opentelemetry-exporter-http-transport packages and switch default HTTP backend to urllib3 (#5389)
  • opentelemetry-sdk: unify logging force_flush timeout defaults to 30000ms (#5438)
  • opentelemetry-python: enable Ruff default ruleset and fix auto-fixable lint issues (#5491)
  • opentelemetry-sdk: SimpleSpanProcessor now drops spans ended after shutdown() instead of passing them to the exporter, and counts them on otel.sdk.processor.span.processed with error.type=already_shutdown. (#5512)
  • Bump pytest to 9.0.3 (#5518)
  • opentelemetry-exporter-otlp-proto-http: clarify that the endpoint= kwarg requires the full signal path (#5633)
  • opentelemetry-sdk: fix typos in SpanLimits docstring (#5658)

Fixed

  • opentelemetry-configuration: perform environment variable substitution on scalar values after parsing the configuration file, so ${VAR} references inside comments and mapping keys are no longer substituted and undefined references in comments no longer abort loading (#5407)
  • opentelemetry-configuration: declarative config environment variable substitution now replaces an unset variable that has no default with an empty value instead of raising an error, per the configuration spec. Resource attributes whose value resolves to null (an unset ${VAR} with no default) are skipped with a warning instead of being inserted as a null value. (#5408)
  • 'scripts/build.sh: add opentelemetry-configurationandopentelemetry-proto-json` to the package to release (#5425)
  • opentelemetry-sdk: fix View instrument-name matching so a view configured with an instrument's real (mixed-case) name is applied; matching is now case-insensitive and platform-independent instead of relying on fnmatch's OS-dependent case handling (#5430)

... (truncated)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)

Version 1.45.0/0.66b0 (2026-09-25)

Added

  • opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)
  • infra: add renovate (#5202)
  • opentelemetry-api, opentelemetry-sdk: add support for extended attribute values everywhere. (#5266)
  • opentelemetry-sdk: wire the top-level log_level field in declarative configuration — when set, maps the OTel SeverityNumber value to a Python logging level and applies it to the opentelemetry logger so SDK internal diagnostics respect the configured severity. (#5351)
  • opentelemetry-sdk: add the new stable AlwaysRecordSampler (#5354)
  • opentelemetry-configuration, opentelemetry-sdk: wire top-level attribute_limits into per-signal providers via declarative config; add log_record_limits support to LoggerProvider (#5365)
  • opentelemetry-exporter-otlp-json-http: add OTLP JSON HTTP exporter package (#5374)
  • opentelemetry-api, opentelemetry-sdk: add enabled() support to the Logger API, SDK, and LogRecordProcessor to let instrumentation skip expensive work when logging is disabled (#5380)
  • opentelemetry-exporter-otlp-json-file: add OTLP JSON file Docker tests (#5412)
  • opentelemetry-configuration: wire the experimental

... (truncated)

Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • 4f0fcfa Prepare release 1.45.0/0.66b0 (#5690)
  • 9406f34 opentelemetry-test-utils: add CapturingSampler for instrumentation tests (#5681)
  • 1fe31a9 fix: update W3CBaggagePropagator to properly handle whitespace (#5680)
  • 008b5b0 feat(config): wire top-level attribute_limits into per-signal providers (#5365)
  • edfad0c [opentelemetry-sdk] Fix overwriting of the service.instance.id which has been...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the uv group across 1 directory with 5 updates
ad62b2e 
Bumps the uv group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `4.1.0` | `4.1.2` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.20.1` | `6.21.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.7.22` | `2026.10.19` |
| [filelock](https://github.com/tox-dev/py-filelock) | `4.0.4` | `4.2.1` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.44.0` | `1.45.1` |



Updates `fastmcp` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v4.1.0...v4.1.2)

Updates `pypdf` from 6.20.1 to 6.21.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.20.1...6.21.2)

Updates `certifi` from 2026.7.22 to 2026.10.19
- [Commits](certifi/python-certifi@2026.07.22...2026.10.19)

Updates `filelock` from 4.0.4 to 4.2.1
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.0.4...4.2.1)

Updates `opentelemetry-api` from 1.44.0 to 1.45.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.44.0...v1.45.1)

---
updated-dependencies:
- dependency-name: fastmcp
  dependency-version: 4.1.2
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pypdf
  dependency-version: 6.21.2
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 24, 2026
@dependabot dependabot Bot mentioned this pull request Oct 24, 2026
Closed
@daggerstuff
daggerstuff merged commit 137a9b4 into master Oct 26, 2026
4 of 8 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/uv-498d35825d branch October 26, 2026 05:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@daggerstuff